From: Arnaldo Carvalho de Melo Date: Wed, 10 Jun 2026 23:34:38 +0000 (-0300) Subject: perf tools: Use snprintf() for root_dir path construction X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b0df6f4d498b1608afccfd6dffb264e6da91693;p=thirdparty%2Flinux.git perf tools: Use snprintf() for root_dir path construction get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in symbol.c use sprintf() to construct paths by prepending root_dir to "/proc/version" and "/proc/kallsyms" respectively. Both write into PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM configuration and is not length-checked. A root_dir at or near PATH_MAX causes a stack buffer overflow. Switch to snprintf() with sizeof(path) to prevent overflow. Reported-by: sashiko-bot Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") Cc: Zhang Yanmin Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo --- diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c index 1ea06fde14e0c..31715366e29ff 100644 --- a/tools/perf/util/machine.c +++ b/tools/perf/util/machine.c @@ -1336,7 +1336,7 @@ static char *get_kernel_version(const char *root_dir) char *name, *tmp; const char *prefix = "Linux version "; - sprintf(version, "%s/proc/version", root_dir); + snprintf(version, sizeof(version), "%s/proc/version", root_dir); file = fopen(version, "r"); if (!file) return NULL; diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c index 2cc911af8c811..cd379ced19e5b 100644 --- a/tools/perf/util/symbol.c +++ b/tools/perf/util/symbol.c @@ -2283,7 +2283,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map) if (!kallsyms_filename) return -1; } else { - sprintf(path, "%s/proc/kallsyms", machine->root_dir); + snprintf(path, sizeof(path), "%s/proc/kallsyms", machine->root_dir); kallsyms_filename = path; }