[PATCH v4 0/4] perf: Fix and optimize maps parsing, boundaries, and bounds safety
From: Ian Rogers
Date: Tue Jul 21 2026 - 14:43:52 EST
It turns out that PATH_MAX is respected by system calls but isn't
respected by file paths in /proc/pid/maps and /proc/pid/smaps. In the
kernel "//toolong" is placed in the filename of mmap/mmap2 events
where the filename is longer than PATH_MAX, do the same in the
mmap/mmap2 synthesis code to avoid overrunning the event buffer -
note, the filename buffer is bounds checked but this makes the
synthesis more similar to the kernel approach. With Gemini's help try
to address other correctness and overrun issues.
V4 addresses review feedback:
- Ensures io__drain_line()'s do-while loop is properly included and
committed directly within Patch 2. When ch == -2 is passed on parsing
errors, the loop correctly reads and discards remaining line
characters until a newline or EOF is reached, preventing tight failure
loops and preserving line synchronization.
- Replaces member array memset destination pointers in Patches 2 & 3
with offsetof() casts on (char *)event to avoid _FORTIFY_SOURCE
runtime array bound aborts when zeroing padding trailers for long
pathnames.
V3 addresses review feedback:
- Updates io__drain_line() loop condition from a while loop to a
do-while loop to ensure initial non-hex/dec failures correctly
drain line remnants.
V2 addresses community review feedback:
- Corrects read_proc_maps_line() and io__drain_line() to safely handle
already consumed newlines, preventing valid map data from being skipped.
- Restores the early exit block for timeouts so the TIMEOUT flag is
always emitted to tools.
- Removes an unused assignment to avoid promoting warnings to build errors.
- Clarifies and dynamically computes the maximum filename length boundaries
using offsetof() to prevent E2BIG errors regardless of struct layout.
Ian Rogers (4):
perf find-map: Remove PATH_MAX 128-byte stack array restriction
perf synthetic-events: Fix line synchronization, bounds, and
truncation bugs in proc maps reader
perf synthetic-events: Fix bounds, stale state, and misc flags in
kernel module synthesis
perf synthetic-events: Fix bounds and union member access in mmap2
build_id synthesis
tools/perf/util/find-map.c | 10 +-
tools/perf/util/synthetic-events.c | 288 ++++++++++++++++++++---------
2 files changed, 208 insertions(+), 90 deletions(-)
--
2.55.0.229.g6434b31f56-goog