diff options
| author | Arnaldo Carvalho de Melo <acme@redhat.com> | 2026-06-10 20:34:38 -0300 |
|---|---|---|
| committer | Arnaldo Carvalho de Melo <acme@redhat.com> | 2026-06-17 08:28:44 -0300 |
| commit | 7b0df6f4d498b1608afccfd6dffb264e6da91693 (patch) | |
| tree | 6fc02fbcedad3e62631713c8ec5e0713595798ff /tools | |
| parent | d2c6069d68ee9d53b05fe38bc2049cc4286fbb16 (diff) | |
perf tools: Use snprintf() for root_dir path construction
get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in
symbol.c use sprintf() to construct paths by prepending root_dir to
"/proc/version" and "/proc/kallsyms" respectively. Both write into
PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM
configuration and is not length-checked. A root_dir at or near
PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof(path) to prevent overflow.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host")
Cc: Zhang Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/perf/util/machine.c | 2 | ||||
| -rw-r--r-- | tools/perf/util/symbol.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c index 1ea06fde14e0..31715366e29f 100644 --- a/tools/perf/util/machine.c +++ b/tools/perf/util/machine.c @@ -1336,7 +1336,7 @@ static char *get_kernel_version(const char *root_dir) char *name, *tmp; const char *prefix = "Linux version "; - sprintf(version, "%s/proc/version", root_dir); + snprintf(version, sizeof(version), "%s/proc/version", root_dir); file = fopen(version, "r"); if (!file) return NULL; diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c index 2cc911af8c81..cd379ced19e5 100644 --- a/tools/perf/util/symbol.c +++ b/tools/perf/util/symbol.c @@ -2283,7 +2283,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map) if (!kallsyms_filename) return -1; } else { - sprintf(path, "%s/proc/kallsyms", machine->root_dir); + snprintf(path, sizeof(path), "%s/proc/kallsyms", machine->root_dir); kallsyms_filename = path; } |