[PATCH v3 perf-tools-next 7/7] perf trace beauty: Validate payload size in augmented perf_event_open beautifier

[Aaron Tomlin]

When pretty-printing augmented perf_event_attr arguments via
syscall_arg__scnprintf_augmented_perf_event_attr(),
arg->augmented.args->value is cast to struct perf_event_attr and read
without verifying that the captured payload is large enough to contain
at least PERF_ATTR_SIZE_VER0 bytes.

If a malformed or truncated perf.data record provides an augmented
payload smaller than PERF_ATTR_SIZE_VER0, accessing attr->size or
executing memcpy(&local_attr, attr, PERF_ATTR_SIZE_VER0) reads memory
past the end of the available buffer. Furthermore, when attr->size is
specified, accessing fields up to attr->size without verifying that
the captured payload contains at least that many bytes risks out-of-bounds
reads.

Validate that arg->augmented.size is at least
sizeof(struct augmented_arg) + PERF_ATTR_SIZE_VER0. If attr->size is
non-zero, verify that it is at least PERF_ATTR_SIZE_VER0 and that the
captured payload contains sufficient bytes before proceeding with
pretty-printing. If validation fails, fall back to printing the raw
pointer value.

Fixes: a9cd6c676685 ("perf trace: Add BPF augmenter to perf_event_open()'s 'struct perf_event_attr' arg")
Reported-by: sashiko-bot <sashiko-bot@xxxxxxxxxx>
Signed-off-by: Aaron Tomlin <atomlin@xxxxxxxxxxx>
---
 tools/perf/trace/beauty/perf_event_open.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/tools/perf/trace/beauty/perf_event_open.c b/tools/perf/trace/beauty/perf_event_open.c
index 6315b46bcdf0..92f84472e7fd 100644
--- a/tools/perf/trace/beauty/perf_event_open.c
+++ b/tools/perf/trace/beauty/perf_event_open.c
@@ -81,8 +81,16 @@ static size_t perf_event_attr___scnprintf(struct perf_event_attr *attr, char *bf
 
 static size_t syscall_arg__scnprintf_augmented_perf_event_attr(struct syscall_arg *arg, char *bf, size_t size)
 {
-	struct perf_event_attr *attr = (void *)arg->augmented.args->value;
+	struct augmented_arg *augmented_arg = arg->augmented.args;
+	struct perf_event_attr *attr;
 	struct perf_event_attr local_attr;
+	size_t payload_size;
+
+	if (arg->augmented.size < (int)(sizeof(*augmented_arg) + PERF_ATTR_SIZE_VER0))
+		return 0;
+
+	attr = (void *)augmented_arg->value;
+	payload_size = arg->augmented.size - sizeof(*augmented_arg);
 
 	/*
 	 * augmented_raw_syscalls.bpf.c (shipped with perf) copies
@@ -93,7 +101,10 @@ static size_t syscall_arg__scnprintf_augmented_perf_event_attr(struct syscall_ar
 	 * without writing to the potentially read-only augmented
 	 * args buffer.
 	 */
-	if (!attr->size) {
+	if (attr->size) {
+		if (attr->size < PERF_ATTR_SIZE_VER0 || payload_size < attr->size)
+			return 0;
+	} else {
 		memcpy(&local_attr, attr, PERF_ATTR_SIZE_VER0);
 		memset((void *)&local_attr + PERF_ATTR_SIZE_VER0, 0,
 		       sizeof(local_attr) - PERF_ATTR_SIZE_VER0);
@@ -107,8 +118,12 @@ static size_t syscall_arg__scnprintf_augmented_perf_event_attr(struct syscall_ar
 
 size_t syscall_arg__scnprintf_perf_event_attr(char *bf, size_t size, struct syscall_arg *arg)
 {
-	if (arg->augmented.args)
-		return syscall_arg__scnprintf_augmented_perf_event_attr(arg, bf, size);
+	if (arg->augmented.args) {
+		size_t printed = syscall_arg__scnprintf_augmented_perf_event_attr(arg, bf, size);
+
+		if (printed)
+			return printed;
+	}
 
 	return scnprintf(bf, size, "%#lx", arg->val);
 }
-- 
2.55.0