[PATCH v5 0/4] perf: Fix and optimize maps parsing, boundaries, and bounds safety

[Ian Rogers]

It turns out that PATH_MAX is respected by system calls but isn't
respected by file paths in /proc/pid/maps and /proc/pid/smaps. In the
kernel "//toolong" is placed in the filename of mmap/mmap2 events
where the filename is longer than PATH_MAX, do the same in the
mmap/mmap2 synthesis code to avoid overrunning the event buffer -
note, the filename buffer is bounds checked but this makes the
synthesis more similar to the kernel approach. With Gemini's help try
to address other correctness and overrun issues.

V5 addresses technical review feedback:
- Clamps pathname buffer sizes in read_proc_maps_line() and module
  synthesis callbacks by subtracting machine->id_hdr_size. This
  guarantees that when sample ID headers are appended to events (such
  as stack-allocated events in machine__init_live()), the event size
  never exceeds sizeof(union perf_event), eliminating stack buffer
  overflow risks.
- Casts member array memset destination pointers to
  (char *)event + offsetof(...) across all synthesis handlers
  (prepare_comm, cgroups, mmap, modules) to prevent _FORTIFY_SOURCE
  array bounds aborts when zeroing padding trailers.
- Confirms explicit clearing of PERF_RECORD_MISC_MMAP_BUILD_ID, build_id,
  and reserved union members in perf_event__synthesize_modules_maps_cb()
  to prevent stale Build-ID state leakage between module iterations.
- Restricts max_filename_len in perf_event__synthesize_mmap2_build_id()
  to the minimum of filename array capacity and union payload space,
  preventing strlcpy fortify aborts even if union perf_event expands in
  the future.

V4 addresses review feedback:
- Ensures io__drain_line()'s do-while loop is committed directly in
  Patch 2.

V3 addresses review feedback:
- Updates io__drain_line() loop condition from a while loop to a
  do-while loop.

V2 addresses community review feedback:
- Corrects read_proc_maps_line() and io__drain_line() to safely handle
  already consumed newlines.
- Restores early exit block for timeouts so TIMEOUT flag is emitted
  to tools.
- Removes unused assignment to avoid promoting warnings to build errors.

Ian Rogers (4):
  perf find-map: Remove PATH_MAX 128-byte stack array restriction
  perf synthetic-events: Fix line synchronization, bounds, and
    truncation bugs in proc maps reader
  perf synthetic-events: Fix bounds, stale state, and misc flags in
    kernel module synthesis
  perf synthetic-events: Fix bounds and union member access in mmap2
    build_id synthesis

 tools/perf/util/find-map.c         |  10 +-
 tools/perf/util/synthetic-events.c | 294 ++++++++++++++++++++---------
 2 files changed, 212 insertions(+), 92 deletions(-)

-- 
2.55.0.229.g6434b31f56-goog