Files
linux/tools/perf/util
Arnaldo Carvalho de Melo 10b3c3d63e perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
synthesize_bpf_prog_name() computes a pointer into the func_info array
using sub_id * info->func_info_rec_size without validating either value.
Both come from perf.data and are untrusted:

- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means
  the finfo pointer would reference a truncated entry, reading past it
  into adjacent data.

- A sub_id >= nr_func_info computes an offset past the func_info buffer,
  causing an out-of-bounds read.

Add bounds checks for both values before computing the pointer offset.
When validation fails, fall through to the non-BTF name path instead
of reading garbage.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 7b612e291a ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:53 -03:00
..
2026-06-15 14:33:49 -03:00
2026-06-15 14:33:49 -03:00
2026-01-13 17:03:25 -03:00
2026-01-13 17:03:25 -03:00
2026-03-13 14:13:02 -07:00
2025-06-09 11:18:17 -07:00
2026-04-02 19:35:16 -07:00
2023-03-14 08:29:46 -03:00
2024-08-19 14:52:13 -03:00
2023-01-23 10:00:47 -03:00
2026-04-05 22:30:52 -07:00
2024-08-12 18:05:14 -03:00
2024-08-19 14:51:46 -03:00
2026-06-15 09:01:27 -03:00
2026-06-15 09:01:27 -03:00
2025-05-02 15:36:14 -03:00
2025-02-10 11:46:02 -08:00
2023-04-06 21:40:28 -03:00
2023-09-12 17:47:00 -03:00
2025-03-10 11:31:24 -07:00
2025-03-10 11:31:24 -07:00
2025-12-17 09:30:37 -03:00
2026-03-26 15:22:18 -07:00
2025-07-11 12:36:40 -07:00
2025-07-11 12:36:40 -07:00
2024-12-12 15:53:36 -03:00
2026-06-03 16:54:09 -03:00
2025-06-09 11:18:18 -07:00
2025-07-26 16:31:43 -07:00
2025-09-19 12:14:29 -03:00
2023-04-10 19:20:53 -03:00
2024-09-27 15:38:52 -03:00