[PATCH v6 0/4] perf: Fix and optimize maps parsing, boundaries, and bounds safety
From: Ian Rogers
Date: Tue Jul 21 2026 - 19:16:11 EST
It turns out that PATH_MAX is respected by system calls but isn't
respected by file paths in /proc/pid/maps and /proc/pid/smaps. In the
kernel "//toolong" is placed in the filename of mmap/mmap2 events
where the filename is longer than PATH_MAX, do the same in the
mmap/mmap2 synthesis code to avoid overrunning the event buffer -
note, the filename buffer is bounds checked but this makes the
synthesis more similar to the kernel approach. With Gemini's help try
to address other correctness and overrun issues.
V6 addresses review feedback:
- Ensures Patch 2 leaves perf_event__synthesize_modules_maps_cb()
completely untouched, preserving the pre-existing build ID clearing logic
in baseline.
- Patch 3 explicitly clears PERF_RECORD_MISC_MMAP_BUILD_ID, build_id, and
reserved union padding members in module synthesis callbacks to
guarantee no stale Build-ID state leaks between module synthesis
iterations.
V5 addresses technical review feedback:
- Clamps pathname buffer sizes in read_proc_maps_line() and module
synthesis callbacks by subtracting machine->id_hdr_size.
- Casts member array memset destination pointers to
(char *)event + offsetof(...) across all synthesis handlers.
- Restricts max_filename_len in perf_event__synthesize_mmap2_build_id()
to the minimum of filename array capacity and union payload space.
V4 addresses review feedback:
- Ensures io__drain_line()'s do-while loop is committed directly in
Patch 2.
V3 addresses review feedback:
- Updates io__drain_line() loop condition from a while loop to a
do-while loop.
V2 addresses community review feedback:
- Corrects read_proc_maps_line() and io__drain_line() to safely handle
already consumed newlines.
- Restores early exit block for timeouts so TIMEOUT flag is emitted
to tools.
- Removes unused assignment to avoid promoting warnings to build errors.
Ian Rogers (4):
perf find-map: Remove PATH_MAX 128-byte stack array restriction
perf synthetic-events: Fix line synchronization, bounds, and
truncation bugs in proc maps reader
perf synthetic-events: Fix bounds, stale state, and misc flags in
kernel module synthesis
perf synthetic-events: Fix bounds and union member access in mmap2
build_id synthesis
tools/perf/util/find-map.c | 10 +-
tools/perf/util/synthetic-events.c | 294 ++++++++++++++++++++---------
2 files changed, 212 insertions(+), 92 deletions(-)
--
2.55.0.229.g6434b31f56-goog