From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08256451068 for ; Mon, 20 Jul 2026 17:55:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.200 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784570125; cv=none; b=YwelQaPe6v6oGoWOfRBKjnzmPagsPerQpLgdu/zJEfyePqaI/Xz3sg2Dx+rhj2MKtg1XsvFaOQXpNbboCyhrlyyuKhwdLGtz4293SjZzW5jIgmTXkjIvUnQWubjFPlox5XThnwwCCJOCeTPDXMInsD/L6fMZJPvZPxuFbx45RpY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784570125; c=relaxed/simple; bh=vVq/yAqli/Ps3YNknNL7qI/CsWifMu7Da0GMqyVVBFk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Content-Type; b=Vet5OL+BcWXPjN/tKFdmcYp32FzKJgvoRLY7zq4qM10yEgEDIFpSZ0i2ELMyB+hDMDAFMp+Y8X7EQoFMrsQc0dN43blImx2InNo4Lw7RGO0KJD9+Wzi8F6DptDmEwMTS7Pvskn4+Oy/yq5DkCCwjf7nNVUcSk4LOH7CP4aejCbw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=O2iBx5Ql; arc=none smtp.client-ip=209.85.215.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="O2iBx5Ql" Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-cb74d5db64eso1543931a12.2 for ; Mon, 20 Jul 2026 10:55:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784570119; x=1785174919; darn=vger.kernel.org; h=content-type:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=XH5gGKH7ZMsz/ICb8uMDOlGzTuN7H6pnWfYS/BF91AI=; b=O2iBx5QlfsA/W5FkaklzhFHWPMqq/SlnQOwBku0TcXZp36zVpvitgqOS7fw2Y62hbj WYM8VVRDZzmSWyaEkgQLqNaFdF3e4KpzPKHy3s2FKg8rLPTy7MCbRI/5+PRMKeW4aUFO JX2EYljOA8YxFQlk2B+E5yHFZKTI1o2xQtA+yGa5djGV+W+korCPzOhpEdJd3KcF5NFh xhrBTzRFXGh/US0/E5kfBYeOhL5zRiXmjlJh9iaz+dWfkzv1yg54QAPpfhot8FiGqCXy Q51FZFS10o9CTzlvmkmDb87HZtrVxPzFigTmtQCkpFi1DyuOE+0tflqM9cjj7L4Jo2uq udEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784570119; x=1785174919; h=content-type:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XH5gGKH7ZMsz/ICb8uMDOlGzTuN7H6pnWfYS/BF91AI=; b=jiJNlszj7jIbVshvn9dR7De8XRdosCHUhWjy/4aZKz69lHb0ZClmDie70YqbPAlTOe 8XFLAXFWaLtfB488GTBH+lmve99+P84NKPv5Q0o2isbd0P+c33dOD2Qen/ilRa0Duxim NV640rhwFQ0Sy9UvhKejGAfIkQf4CCStwszxUNd80RSyt0VK5bEl+aegEh/t1amF+lZF jLZbcABsRyzE+iYy4dow9wmDGc2RQ8vqKUpUk1eCdnAjYnHQXAeS1a21KRufXmOvm5C5 3w0U3nLOZ8feD74rYWTl27CD0sIboJkt5RwFXIR1O2EzpbjyC5eeczPJt1gQQK5UO0p9 aXhg== X-Forwarded-Encrypted: i=1; AHgh+RoR6QTwDxqQG51HAHZ1fkBYGq3dtzYce7DF57+wXKlflvucb2z+N7Etqb2RRuYvZMdUL5Z17g7YrIJqEwA=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1aCuA15OnMoSzq7ZZN5BxefulI5NahdozvQk0Yu4a4bp7QSja mJiMTQDkTKvPR1F6NEGOYE5bvKjVWxzAVeaCAAAOFt50XLCAkDKCAYWvn1NiARITs+0qs+KnOVH PjwMRT9PPjg== X-Received: from dlj39.prod.google.com ([2002:a05:7022:527:b0:13c:e616:911a]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:b786:b0:3c3:8c91:5da0 with SMTP id adf61e73a8af0-3c3ad793aacmr16123503637.15.1784570119323; Mon, 20 Jul 2026 10:55:19 -0700 (PDT) Date: Mon, 20 Jul 2026 10:54:55 -0700 In-Reply-To: <20260720175455.3645946-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260720175455.3645946-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.229.g6434b31f56-goog Message-ID: <20260720175455.3645946-5-irogers@google.com> Subject: [PATCH v1 4/4] perf synthetic-events: Fix bounds and union member access in mmap2 build_id synthesis From: Ian Rogers To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Jiri Olsa , Ian Rogers , Adrian Hunter , James Clark , Ravi Bangoria , Swapnil Sapkal , linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Fix a critical logic bug in perf_event__synthesize_mmap2_build_id() where the wrong union member structure size and offset boundaries were utilized. Safely calculate and clamp maximum filename length to guarantee absolute stack boundary protections for ID sample trailers, and remove void-pointer arithmetic to meet strict standard C compliance. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/util/synthetic-events.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c index aab958cb3bc5..cb5b659822f5 100644 --- a/tools/perf/util/synthetic-events.c +++ b/tools/perf/util/synthetic-events.c @@ -2441,13 +2441,16 @@ int perf_event__synthesize_mmap2_build_id(const struct perf_tool *tool, size_t filename_len = strlen(filename); size_t ev_len; u64 sample_type = sample->evsel ? sample->evsel->core.attr.sample_type : 0; - void *array; + void *array = &ev; int ret; + size_t max_filename_len; - if (filename_len >= sizeof(ev.mmap2.filename)) - return -EINVAL; + max_filename_len = sizeof(ev.mmap2.filename) - (MAX_ID_HDR_ENTRIES * sizeof(__u64)); - ev_len = sizeof(ev.mmap2) - sizeof(ev.mmap2.filename) + filename_len + 1; + if (filename_len > max_filename_len) + filename_len = max_filename_len; + + ev_len = offsetof(struct perf_record_mmap2, filename) + filename_len + 1; ev_len = PERF_ALIGN(ev_len, sizeof(u64)); if (ev_len + MAX_ID_HDR_ENTRIES * sizeof(__u64) > sizeof(ev)) @@ -2467,16 +2470,15 @@ int perf_event__synthesize_mmap2_build_id(const struct perf_tool *tool, ev.mmap2.build_id_size = bid->size; if (ev.mmap2.build_id_size > sizeof(ev.mmap2.build_id)) - ev.build_id.size = sizeof(ev.mmap2.build_id); + ev.mmap2.build_id_size = sizeof(ev.mmap2.build_id); memcpy(ev.mmap2.build_id, bid->data, ev.mmap2.build_id_size); ev.mmap2.prot = prot; ev.mmap2.flags = flags; - memcpy(ev.mmap2.filename, filename, min(strlen(filename), sizeof(ev.mmap.filename))); + strlcpy(ev.mmap2.filename, filename, filename_len + 1); - array = &ev; - array += ev.header.size; + array = (void *)((char *)&ev + ev.header.size); ret = perf_event__synthesize_id_sample(array, sample_type, sample); if (ret < 0) return ret; -- 2.55.0.229.g6434b31f56-goog