Re: [PATCH 12/12] perf jitdump: Validate unwinding sizes against record payload

[Ian Rogers]

On Wed, Aug 5, 2026 at 6:32 AM Arnaldo Carvalho de Melo <acme@xxxxxxxxxx> wrote:
>
> From: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
>
> jit_repipe_unwinding_info() copies unwinding_size and eh_frame_hdr_size
> from the jitdump record into jd-> fields without checking them against
> the actual payload size.  Downstream, jit_add_eh_frame_info() in
> genelf.c computes unwinding_table_size = unwinding_size -
> eh_frame_hdr_size, which underflows when eh_frame_hdr_size >
> unwinding_size.  The result is passed as d->d_size to libelf, causing
> an OOB heap read into the output ELF file.
>
> Validate that unwinding_size fits within the record payload and that
> eh_frame_hdr_size does not exceed unwinding_size before allocating or
> storing the values, so a bogus record cannot force a large allocation
> that is then discarded.
>
> mapped_size is likewise taken from the record and was narrowed into an
> int for the mmap2 len computation in jit_repipe_code_load() and
> jit_repipe_code_move(); values above INT_MAX would turn negative,
> producing a wrong mmap2 length.  Use uint64_t for usize so the value
> cannot truncate.
>
> Fixes: 0284fecd13b6db3e ("perf jit: Add unwinding support")
> Reported-by: sashiko-bot <sashiko-bot@xxxxxxxxxx>
> Cc: Stefano Sanfilippo <ssanfilippo@xxxxxxxxxxxx>
> Cc: Stephane Eranian <eranian@xxxxxxxxxx>
> Assisted-by: Claude:claude-opus-4.6
> Assisted-by: Opencode:mimo-v2.5-free
> Signed-off-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>

Reviewed-by: Ian Rogers <irogers@xxxxxxxxxx>

Thanks!
Ian

> ---
>  tools/perf/util/jitdump.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
> index 5f3a53f818c29f58..385c19b864aeee4c 100644
> --- a/tools/perf/util/jitdump.c
> +++ b/tools/perf/util/jitdump.c
> @@ -462,7 +462,8 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd, union jr_entry *jr)
>         u16 idr_size;
>         const char *sym;
>         uint64_t count;
> -       int ret, csize, usize;
> +       int ret, csize;
> +       uint64_t usize;
>         pid_t nspid, pid, tid;
>         struct {
>                 u32 pid, tid;
> @@ -543,7 +544,7 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd, union jr_entry *jr)
>
>         event->mmap2.pgoff = GEN_ELF_TEXT_OFFSET;
>         event->mmap2.start = addr;
> -       event->mmap2.len   = usize ? ALIGN_8(csize) + usize : csize;
> +       event->mmap2.len   = usize ? ALIGN_8((uint64_t)csize) + usize : (uint64_t)csize;
>         event->mmap2.pid   = pid;
>         event->mmap2.tid   = tid;
>         event->mmap2.ino   = st.st_ino;
> @@ -612,7 +613,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd, union jr_entry *jr)
>         char *filename;
>         size_t size;
>         struct stat st;
> -       int usize;
> +       uint64_t usize;
>         u16 idr_size;
>         int ret;
>         pid_t nspid, pid, tid;
> @@ -761,6 +762,18 @@ jit_repipe_unwinding_info(struct jit_buf_desc *jd, union jr_entry *jr)
>                 return -1;
>
>         unwinding_data_size  = jr->prefix.total_size - sizeof(jr->unwinding);
> +
> +       /*
> +        * Validate sizes before allocating — jit_add_eh_frame_info()
> +        * computes unwinding_size - eh_frame_hdr_size and uses the
> +        * result as a buffer length for libelf.
> +        */
> +       if (jr->unwinding.unwinding_size > unwinding_data_size ||
> +           jr->unwinding.eh_frame_hdr_size > jr->unwinding.unwinding_size) {
> +               pr_warning("jitdump: invalid unwinding sizes in unwinding_info record\n");
> +               return -1;
> +       }
> +
>         unwinding_data = malloc(unwinding_data_size);
>         if (!unwinding_data)
>                 return -1;
> --
> 2.55.0
>