Re: [PATCH v8 1/6] perf mem: Fix size tracking for mem_lvl's in perf_script__meminfo_scnprintf()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The helper functions for memory event formatting (`perf_mem__lvl_scnprintf`, `perf_mem__snp_scnprintf`, `perf_mem__tlb_scnprintf`) are vulnerable to severe stack buffer overflows and integer underflows due to unvalidated size decrements, unbounded `strcat` usage, and API contract violations.
--

commit 980e511e3799aa8f7f553d523c4cd00aa00aadf1
Author: Thomas Falcon <thomas.falcon@intel.com>

perf mem: Fix size tracking for mem_lvl's in perf_script__meminfo_scnprintf()

When printing memory info in perf script, the entire size of the
buffer is passed to perf_mem__lvl_scnprintf() instead of the remaining
size. Pass the remaining buffer size instead.

> diff --git a/tools/perf/util/mem-events.c b/tools/perf/util/mem-events.c
> index 0b49fce251fcc..4e490f9cd3488 100644
> --- a/tools/perf/util/mem-events.c
> +++ b/tools/perf/util/mem-events.c
> @@ -610,7 +610,7 @@ int perf_script__meminfo_scnprintf(char *out, size_t sz, const struct mem_info *
>  	i += scnprintf(out, sz, "|OP ");
>  	i += perf_mem__op_scnprintf(out + i, sz - i, mem_info);
>  	i += scnprintf(out + i, sz - i, "|LVL ");
> -	i += perf_mem__lvl_scnprintf(out + i, sz, mem_info);
> +	i += perf_mem__lvl_scnprintf(out + i, sz - i, mem_info);

[Severity: High]
This is a pre-existing issue, but does passing sz - i here expose
severe integer underflows and stack buffer overflows inside
perf_mem__lvl_scnprintf() and related functions?

The functions perf_mem__lvl_scnprintf(), perf_mem__snp_scnprintf(), and
perf_mem__tlb_scnprintf() begin with an unconditional decrement of sz:

tools/perf/util/mem-events.c:perf_mem__lvl_scnprintf() {
    ...
	sz -= 1; /* -1 for null termination */
	out[0] = '\0';
    ...

If the remaining space passed by the caller (sz - i) is small (e.g., 0),
this underflows to SIZE_MAX. If it is 1, sz becomes 0, and subsequent
length calculations like sz - l underflow.

Furthermore, these functions use unbounded strcat() calls which ignore the
buffer capacity entirely:

tools/perf/util/mem-events.c:perf_mem__lvl_scnprintf() {
    ...
			strcat(out, "Remote ");
			l += 7;
    ...
    na:
	strcat(out, "N/A");
	return 3;
    ...

Because strcat() doesn't respect sz, a maliciously crafted perf.data file
can cause this to overflow the 100-byte stack buffer used for the decode
array in builtin-script.c.

Finally, if the callee returns a length larger than the remaining size, the
caller's offset i is advanced past the buffer size.

Does this cause the caller's own sz - i calculations to underflow in the
subsequent format calls below?

>  	i += scnprintf(out + i, sz - i, "|SNP ");
>  	i += perf_mem__snp_scnprintf(out + i, sz - i, mem_info);
>  	i += scnprintf(out + i, sz - i, "|TLB ");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910194324.98002-1-thomas.falcon@intel.com?part=1