]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow
authorArnaldo Carvalho de Melo <acme@redhat.com>
Mon, 8 Jun 2026 01:39:53 +0000 (22:39 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 10 Jun 2026 21:56:01 +0000 (18:56 -0300)
commite1a2c9d70b312acc262f6be936dd5bbd9bbc6236
tree48187c840c538e9aba022852acf95f6d2722f8a6
parentae75956c166fe169b8c137bf375305fc97820a62
perf hwmon: Fix parse_hwmon_filename() strlcpy buffer overflow

parse_hwmon_filename() strips the "_alarm" suffix from event names
by copying into a 24-byte stack buffer:

    strlcpy(fn_type, fn_item, fn_item_len - 5);

The third argument is the source length minus the suffix, not the
destination buffer capacity.  A long event name ending in "_alarm"
can have fn_item_len - 5 > sizeof(fn_type), causing strlcpy() to
write past the 24-byte fn_type[] array.  The assert() only validates
that the longest *valid* hwmon item fits, but does not protect
against crafted input.

Clamp the strlcpy size to min(fn_item_len - 5, sizeof(fn_type)).

Fixes: 4810b761f812da3c ("perf hwmon_pmu: Add hwmon filename parser")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/hwmon_pmu.c