Re: [PATCH v4 0/5] perf trace-event: Fix overflow, loop and cleanup bugs

[Namhyung Kim <namhyung@kernel.org>]

On Sun, 26 Jul 2026 00:19:48 +0530, Tanushree Shah wrote:
> This series fixes five security issues in trace-event-read.c and
> trace-event.c:
> 1. Stack buffer overflow in read_string() when a string exceeds
>    BUFSIZ, due to a missing bounds check.
> 2. Integer truncation when passing 64-bit sizes into do_read() and
>    skip(), which use 'int' parameters, causing uninitialized memory
>    to be dumped and parsers to read out of bounds.
> 3. Double free / use-after-free in trace_event__cleanup(): it frees
>    t->pevent but never clears the pointer, so calling it twice on
>    the same trace_event touches already-freed memory. Also fixes a
>    related leak in trace_event__init(), which overwrites
>    t->pevent/t->plugin_list without releasing any existing handle
>    if called more than once on the same struct.
> 4. Heap buffer overflow in read_ftrace_printk() and
>    read_saved_cmdline(): size + 1 can overflow to 0 in malloc(),
>    allocating a tiny buffer while a huge read is still attempted
>    into it.
> 5. Infinite loop in skip(): it does not check do_read()'s return
>    value, so a crafted size can spin the loop indefinitely.
> 
> [...]
Applied to perf-tools-next, thanks!

Best regards,
Namhyung