Re: [PATCH v3 perf-tools-next 7/7] perf trace beauty: Validate payload size in augmented perf_event_open beautifier

[sashiko-bot@kernel.org]

> When pretty-printing augmented perf_event_attr arguments via
> syscall_arg__scnprintf_augmented_perf_event_attr(),
> arg->augmented.args->value is cast to struct perf_event_attr and read
> without verifying that the captured payload is large enough to contain
> at least PERF_ATTR_SIZE_VER0 bytes.
> 
> If a malformed or truncated perf.data record provides an augmented
> payload smaller than PERF_ATTR_SIZE_VER0, accessing attr->size or
> executing memcpy(&local_attr, attr, PERF_ATTR_SIZE_VER0) reads memory
> past the end of the available buffer. Furthermore, when attr->size is
> specified, accessing fields up to attr->size without verifying that
> the captured payload contains at least that many bytes risks out-of-bounds
> reads.
> 
> Validate that arg->augmented.size is at least
> sizeof(struct augmented_arg) + PERF_ATTR_SIZE_VER0. If attr->size is
> non-zero, verify that it is at least PERF_ATTR_SIZE_VER0 and that the
> captured payload contains sufficient bytes before proceeding with
> pretty-printing. If validation fails, fall back to printing the raw
> pointer value.
> 
> Fixes: a9cd6c676685 ("perf trace: Add BPF augmenter to perf_event_open()'s 'struct perf_event_attr' arg")
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919005530.728615-1-atomlin@atomlin.com?part=7