summaryrefslogtreecommitdiff
path: root/tools/perf/scripts/python/bin/stackcollapse-record
diff options
context:
space:
mode:
authorArnaldo Carvalho de Melo <acme@redhat.com>2026-05-02 14:51:05 -0300
committerArnaldo Carvalho de Melo <acme@redhat.com>2026-05-29 11:44:34 -0300
commitd88e954c8271c9c47d6d50dcfdd864e6b031d166 (patch)
treec7d080604b7d321769f4b1f234dbb48ff6477111 /tools/perf/scripts/python/bin/stackcollapse-record
parent6e803f1e0198f436d512f9b0eebd89ec2a85ac85 (diff)
perf session: Check for decompression buffer size overflow
On 32-bit systems, sizeof(struct decomp) + decomp_len can wrap size_t when comp_mmap_len is large. The preceding patch validates comp_mmap_len alignment but does not cap the upper bound, so two additions can still overflow: 1. decomp_len += decomp_last_rem: on 32-bit, adding a u64 to size_t silently truncates, producing a corrupted decomp_len that would bypass the subsequent overflow check and result in an undersized buffer allocation. 2. sizeof(struct decomp) + decomp_len: the final addition could overflow on systems with small size_t. Add explicit overflow checks before each addition as defense-in-depth. Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers <irogers@google.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-record')
0 files changed, 0 insertions, 0 deletions