Re: [PATCH v7 0/5] perf: Fix and optimize maps parsing, boundaries, and bounds safety

[Ian Rogers]

On Tue, Jul 21, 2026 at 4:52 PM Ian Rogers <irogers@xxxxxxxxxx> wrote:
>
> It turns out that PATH_MAX is respected by system calls but isn't
> respected by file paths in /proc/pid/maps and /proc/pid/smaps. In the
> kernel "//toolong" is placed in the filename of mmap/mmap2 events
> where the filename is longer than PATH_MAX, do the same in the
> mmap/mmap2 synthesis code to avoid overrunning the event buffer -
> note, the filename buffer is bounds checked but this makes the
> synthesis more similar to the kernel approach. With Gemini's help try
> to address other correctness and overrun issues.
>
> V7 addresses security review feedback:
> - Adds a standalone patch (Patch 3/5) to fix a pre-existing stack
>   buffer overflow in perf_event__synthesize_cgroup(). Eliminates
>   in-place null padding mutation of the path stack buffer, calculates
>   aligned path_len using PERF_ALIGN, clamps raw_path_len to account
>   for machine->id_hdr_size, and uses strlcpy with combined memset for
>   alignment and sample ID header padding.
>
> V6 addresses review feedback:
> - Ensures Patch 2 leaves module synthesis callbacks completely
>   untouched, preserving the pre-existing build ID clearing logic in
>   baseline.
> - Patch 4 explicitly clears PERF_RECORD_MISC_MMAP_BUILD_ID, build_id, and
>   reserved union padding members in module synthesis callbacks to guarantee
>   no stale Build-ID state leaks between module synthesis iterations.
>
> V5 addresses technical review feedback:
> - Clamps pathname buffer sizes in read_proc_maps_line() and module
>   synthesis callbacks by subtracting machine->id_hdr_size.
> - Casts member array memset destination pointers to
>   (char *)event + offsetof(...) across all synthesis handlers.
> - Restricts max_filename_len in perf_event__synthesize_mmap2_build_id()
>   to the minimum of filename array capacity and union payload space.
>
> V4 addresses review feedback:
> - Ensures io__drain_line()'s do-while loop is committed directly in
>   Patch 2.
>
> V3 addresses review feedback:
> - Updates io__drain_line() loop condition from a while loop to a
>   do-while loop.
>
> V2 addresses community review feedback:
> - Corrects read_proc_maps_line() and io__drain_line() to safely handle
>   already consumed newlines.
> - Restores early exit block for timeouts so TIMEOUT flag is emitted
>   to tools.
> - Removes unused assignment to avoid promoting warnings to build errors.
>
> Ian Rogers (5):
>   perf find-map: Remove PATH_MAX 128-byte stack array restriction
>   perf synthetic-events: Fix line synchronization, bounds, and
>     truncation bugs in proc maps reader
>   perf synthetic-events: Fix stack buffer overflow and bounds in cgroup
>     synthesis
>   perf synthetic-events: Fix bounds, stale state, and misc flags in
>     kernel module synthesis
>   perf synthetic-events: Fix bounds and union member access in mmap2
>     build_id synthesis

So while Sashiko is reporting yet more pre-existing issues, I'm going
to stop here. The changes in these patches have no issues:
https://sashiko.dev/#/patchset/20260721235254.294053-1-irogers%40google.com

Thanks,
Ian

>  tools/perf/util/find-map.c         |  10 +-
>  tools/perf/util/synthetic-events.c | 309 ++++++++++++++++++++---------
>  2 files changed, 223 insertions(+), 96 deletions(-)
>
> --
> 2.55.0.229.g6434b31f56-goog
>