linux-stable.git/tools/perf/util/dso.c, branch linux-rolling-stable

perf dso: Set standard errno on decompression failure

2026-07-24T14:20:17+00:00

[ Upstream commit 1a5f9334a45a6b0c1cd7341cc72a3b87adad1d27 ]

dso__get_filename() sets errno to a negative custom DSO_LOAD_ERRNO
value when kernel module decompression fails:

  errno = *dso__load_errno(dso);  /* e.g. -9996 */

The caller __open_dso() then computes fd = -errno, producing a large
positive value (9996) that looks like a valid file descriptor.  This
can cause close_data_fd() to close an unrelated fd used by another
subsystem.

Set errno to EIO instead.  The detailed error code is already stored
in dso__load_errno(dso) for diagnostic messages.

Fixes: 1d6b3c9ba756a513 ("perf tools: Decompress kernel module when reading DSO data")
Reported-by: sashiko-bot 
Cc: Namhyung Kim 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf bpf: Validate array presence before casting BPF prog info pointers

2026-07-24T14:20:17+00:00

[ Upstream commit 5ebf4137d23a4fd6c0cc6a6fb766ee60d2b09193 ]

Several functions cast bpf_prog_info fields (jited_ksyms,
jited_func_lens, jited_prog_insns) from u64 to pointers and
dereference them.  These fields are only valid pointers if
bpil_offs_to_addr() converted their file offsets to addresses, which
only happens when the corresponding PERF_BPIL_* bits are set in
info_linear->arrays.

A crafted perf.data can leave these bits unset while setting non-zero
counts and offset values, causing the functions to dereference raw file
offsets as pointers.

Add array bitmask validation to all perf.data processing paths:

  - __bpf_event__print_bpf_prog_info(): check JITED_KSYMS and
    JITED_FUNC_LENS (changed to take struct perf_bpil *)
  - machine__process_bpf_event_load(): check JITED_KSYMS
  - bpf_read(): check JITED_INSNS before memcpy from jited_prog_insns
  - dso__disassemble_filename(): check JITED_INSNS before returning
    jited_prog_insns pointer

Fixes: f8dfeae009effc0b ("perf bpf: Show more BPF program info in print_bpf_prog_info()")
Reported-by: sashiko-bot 
Cc: Song Liu 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf dso: Set error code when open() fails on uncompressed fallback path

2026-07-24T14:20:15+00:00

[ Upstream commit d2c6069d68ee9d53b05fe38bc2049cc4286fbb16 ]

filename__decompress() has an early return for files that are not
actually compressed, where it calls open() directly.  When open()
fails, the function returns -1 but never sets *err.  The caller chain
(decompress_kmodule → dso__decompress_kmodule_path → dso__get_filename)
then reads *dso__load_errno(dso) to set errno, but that field was never
populated, so errno gets a stale or zero value.

With errno=0, __open_dso() computes fd = -errno = 0, which is non-
negative, so callers treat fd 0 (stdin) as a valid DSO file descriptor.

Set *err = errno when open() fails on the uncompressed path, matching
the error handling on the compressed path at line 354.

Reported-by: sashiko-bot 
Fixes: 8b42b7e5e8b5692b ("perf tools: Add is_compressed callback to compressions array")
Cc: Jiri Olsa 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf dso: Fix heap overflow in dso__get_filename() on decompressed path

2026-07-24T14:20:15+00:00

[ Upstream commit f973e52a99776fcc473488984828d1fce56d5382 ]

dso__get_filename() allocates name with malloc(PATH_MAX), but the
dso__filename_with_chroot() path replaces name with an asprintf'd
exact-size string (e.g. 8 bytes for "/a/b.ko").  When the DSO needs
decompression, dso__decompress_kmodule_path() writes the temp path
("/tmp/perf-kmod-XXXXXX", 22 bytes) into newpath, and strcpy(name,
newpath) overflows the smaller allocation.

Replace the strcpy with strdup(newpath) + free(name) so the buffer
is always correctly sized for its content.

Reported-by: sashiko-bot 
Fixes: 1d6b3c9ba756a513 ("perf tools: Decompress kernel module when reading DSO data")
Reviewed-by: Ian Rogers 
Cc: Namhyung Kim 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf tools: Use snprintf() in dso__read_running_kernel_build_id()

2026-07-24T14:20:11+00:00

[ Upstream commit 2ea64782a428bed74f595961e651ceb8c4c5bf22 ]

dso__read_running_kernel_build_id() uses sprintf() to format a sysfs
path from machine->root_dir into a PATH_MAX buffer.  If root_dir is
close to PATH_MAX in length, appending "/sys/kernel/notes" (18 bytes)
overflows the stack buffer.

Switch to snprintf() with sizeof(path) to prevent the overflow.

Reported-by: sashiko-bot 
Fixes: cdd059d731eeb466 ("perf tools: Move dso_* related functions into dso object")
Cc: Jiri Olsa 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf tools: Fix uninitialized pathname on uncompressed fallback in filename__decompress()

2026-07-24T14:20:11+00:00

[ Upstream commit 51cdb188edeaf389e4377859b9c483c19ce5a259 ]

filename__decompress() has an early return path for files that are not
actually compressed.  This path returns the fd from open() directly but
never writes to the pathname output parameter, leaving the caller with
an uninitialized buffer despite a successful return.

Callers like dso__decompress_kmodule_path() pass pathname to
decompress_kmodule() which uses it to set the decompressed file path.
If pathname is uninitialized, subsequent operations on the path produce
undefined behavior.

Fix by setting pathname to an empty string on the uncompressed path.
Callers already check for an empty pathname to distinguish temporary
decompressed files (which need unlink) from the original file.

Reported-by: sashiko-bot 
Fixes: 7ac22b088afe26a4 ("perf tools: Add filename__decompress function")
Cc: Jiri Olsa 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf tools: Use mkostemp() for O_CLOEXEC on temporary files

2026-07-24T14:20:10+00:00

[ Upstream commit b8acc68f1382a3f380a0e7320a95d328ac5e9027 ]

mkstemp() creates file descriptors without the close-on-exec flag.
These fds leak to child processes spawned during symbol resolution
(addr2line, objdump), wasting descriptors and potentially exposing
temporary file contents.

Replace mkstemp() with mkostemp(tmpbuf, O_CLOEXEC) at all three
call sites:

  - filename__decompress() in dso.c
  - read_gnu_debugdata() in symbol-elf.c
  - kcore__init() in symbol-elf.c

Fixes: 42b3fa670825983f ("perf tools: Introduce dso__decompress_kmodule_{fd,path}")
Fixes: b10f74308e130527 ("perf symbol: Support .gnu_debugdata for symbols")
Fixes: afba19d9dc8eba66 ("perf symbols: Workaround objdump difficulties with kcore")
Reported-by: sashiko-bot 
Cc: Adrian Hunter 
Cc: Namhyung Kim 
Cc: Stephen Brennan 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf tools: Add O_CLOEXEC to open() calls in DSO and ELF code

2026-07-24T14:20:09+00:00

[ Upstream commit b145137fec13dc8fc7fcb14193ce395a1164e3a1 ]

open() calls in dso.c and symbol-elf.c omit O_CLOEXEC, which leaks
file descriptors to child processes spawned during symbol resolution
(e.g., addr2line, objdump).  This can exhaust the fd limit during
long profiling sessions or when processing many DSOs.

Add O_CLOEXEC to all open() calls in both files (12 call sites).

Fixes: cdd059d731eeb466 ("perf tools: Move dso_* related functions into dso object")
Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c")
Reported-by: sashiko-bot 
Reviewed-by: Ian Rogers 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf thread: Add optional e_flags output argument to thread__e_machine

2026-01-26T21:21:20+00:00

The e_flags are needed to accurately compute complete perf register
information for CSKY.

Add the ability to read and have this value associated with a thread.

This change doesn't wire up the use of the e_flags except in disasm
where use already exists but just wasn't set up yet.

Signed-off-by: Ian Rogers 
Cc: Aditya Bodkhe 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Athira Rajeev 
Cc: Chun-Tse Shao 
Cc: Guo Ren 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Sergei Trofimovich 
Cc: Shimin Guo 
Cc: Stephen Brennan 
Cc: Swapnil Sapkal 
Cc: Tianyou Li 
Signed-off-by: Arnaldo Carvalho de Melo

perf dso: Factor out e_machine reading for use in thread

2026-01-26T21:21:20+00:00

Factor out the resilient e_machine reading code in dso so that it may
be used in thread.

As there is no dso in that case, make the dso optional.

This makes some minor other changes as the swap type from the dso cannot
be ascertained.

Signed-off-by: Ian Rogers 
Cc: Aditya Bodkhe 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Athira Rajeev 
Cc: Chun-Tse Shao 
Cc: Guo Ren 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Sergei Trofimovich 
Cc: Shimin Guo 
Cc: Stephen Brennan 
Cc: Swapnil Sapkal 
Cc: Tianyou Li 
Signed-off-by: Arnaldo Carvalho de Melo