]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf hwmon: Fix off-by-one null termination on sysfs reads
authorArnaldo Carvalho de Melo <acme@redhat.com>
Mon, 8 Jun 2026 01:38:26 +0000 (22:38 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 10 Jun 2026 21:56:01 +0000 (18:56 -0300)
commit1847c5fae344a0fb9cc0f95be40b378359c6fc3b
treec7690524adcdfa696ed4df06a2374a8e2c0e4249
parent31d596054550f793508abe7dd593853ece47d428
perf hwmon: Fix off-by-one null termination on sysfs reads

Three functions read sysfs files into fixed-size stack buffers using
the full buffer size, then null-terminate at buf[read_len].  If the
read fills the buffer exactly, read_len equals sizeof(buf) and the
null byte writes one past the array, corrupting an adjacent stack
variable.

Fix all three by reading sizeof(buf) - 1 bytes, reserving space for
the null terminator:

  - hwmon_pmu__read_events(): buf[128]
  - hwmon_pmu__describe_items(): buf[64]
  - evsel__hwmon_pmu_read(): buf[32]

Fixes: 53cc0b351ec99278 ("perf hwmon_pmu: Add a tool PMU exposing events from hwmon in sysfs")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/hwmon_pmu.c