perf tools: Use snprintf() for root_dir path construction

get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in
symbol.c use sprintf() to construct paths by prepending root_dir to
"/proc/version" and "/proc/kallsyms" respectively.  Both write into
PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM
configuration and is not length-checked.  A root_dir at or near
PATH_MAX causes a stack buffer overflow.

Switch to snprintf() with sizeof(path) to prevent overflow.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host")
Cc: Zhang Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 1ea06fde14e0cd789f565d2ab91721eba6320a11..31715366e29ff704ff73c08e1a680863d81c48bc 100644 (file)
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1336,7 +1336,7 @@ static char *get_kernel_version(const char *root_dir)
        char *name, *tmp;
        const char *prefix = "Linux version ";
 
-       sprintf(version, "%s/proc/version", root_dir);
+       snprintf(version, sizeof(version), "%s/proc/version", root_dir);
        file = fopen(version, "r");
        if (!file)
                return NULL;

diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 2cc911af8c81115ba08e85198c7aaf51535b3a0e..cd379ced19e5b0a0c6c7450405219e1f74c560ef 100644 (file)
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -2283,7 +2283,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map)
                if (!kallsyms_filename)
                        return -1;
        } else {
-               sprintf(path, "%s/proc/kallsyms", machine->root_dir);
+               snprintf(path, sizeof(path), "%s/proc/kallsyms", machine->root_dir);
                kallsyms_filename = path;
        }