github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf synthetic-events: Fix stack buffer overflow and bounds in cgroup synthesis

Browse Source 
Fix a pre-existing stack buffer overflow bug in
perf_event__synthesize_cgroup() where an in-place null padding loop wrote
bytes past the end of the cgrp_root stack array buffer during cgroup tree
traversal. Eliminate in-place path mutation, use PERF_ALIGN for path_len,
clamp raw_path_len to prevent sample ID header trailer overruns, and use
strlcpy with combined zero padding for alignment and sample ID headers.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
This commit is contained in:
Ian Rogers 2026-07-21 16:52:52 -07:00 committed by Namhyung Kim
parent 505a498a37
commit 093f58e60e
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
tools/perf/util/synthetic-events.c
View File

@ -635,15 +635,22 @@ static int perf_event__synthesize_cgroup(const struct perf_tool *tool,
struct machine *machine)
{
size_t event_size = sizeof(event->cgroup) - sizeof(event->cgroup.path);
size_t path_len = strlen(path) - mount_len + 1;
size_t raw_path_len, path_len, max_path_len;
struct {
struct file_handle fh;
uint64_t cgroup_id;
} handle;
int mount_id;
while (path_len % sizeof(u64))
path[mount_len + path_len++] = '\0';
if (strlen(path) < mount_len)
return -1;
max_path_len = sizeof(event->cgroup.path) - machine->id_hdr_size;
raw_path_len = strlen(path) - mount_len + 1;
if (raw_path_len > max_path_len)
raw_path_len = max_path_len;
path_len = PERF_ALIGN(raw_path_len, sizeof(u64));
memset(&event->cgroup, 0, event_size);
@ -657,9 +664,9 @@ static int perf_event__synthesize_cgroup(const struct perf_tool *tool,
}
event->cgroup.id = handle.cgroup_id;
strncpy(event->cgroup.path, path + mount_len, path_len);
memset((char *)event + offsetof(struct perf_record_cgroup, path) + path_len,
0, machine->id_hdr_size);
strlcpy(event->cgroup.path, path + mount_len, raw_path_len);
memset((char *)event + offsetof(struct perf_record_cgroup, path) + raw_path_len,
0, (path_len - raw_path_len) + machine->id_hdr_size);
if (perf_tool__process_synth_event(tool, event, machine, process) < 0) {
pr_debug("process synth event failed\n");