This series fixes five security issues in trace-event-read.c and trace-event.c: 1. Stack buffer overflow in read_string() when a string exceeds BUFSIZ, due to a missing bounds check. 2. Integer truncation when passing 64-bit sizes into do_read() and skip(), which use 'int' parameters, causing uninitialized memory to be dumped and parsers to read out of bounds. 3. Double free / use-after-free in trace_event__cleanup(): it frees t->pevent but never clears the pointer, so calling it twice on the same trace_event touches already-freed memory. 4. Heap buffer overflow in read_ftrace_printk(): size + 1 can overflow to 0 in malloc(), allocating a tiny buffer while a huge read is still attempted into it. 5. Infinite loop in skip(): it does not check do_read()'s return value, so a crafted size can spin the loop indefinitely.
Patches 4 and 5 are latent bugs that patch 2's type fix exposes by removing accidental truncation that had been masking them. Tanushree Shah (5): perf trace-event: Fix buffer overflow in read_string() perf trace-event: Fix integer truncation in do_read() and skip() perf trace-event: Avoid double free in trace_event__cleanup() perf trace-event: Fix heap buffer overflow in read_ftrace_printk() perf trace-event: Fix infinite loop in skip() tools/perf/util/trace-event-read.c | 48 +++++++++++++++++++----------- tools/perf/util/trace-event.c | 4 +++ 2 files changed, 35 insertions(+), 17 deletions(-) --- Changes in v3: - Added new patch to fix double free in trace_event__cleanup(). - Added new patch to fix heap buffer overflow in read_ftrace_printk(). - Added new patch to fix infinite loop in skip(). Changes in v2: - Added new patch to fix integer truncation in do_read() and skip(). - Organized as patch series to separate the two security fixes. v1: https://lore.kernel.org/linux-perf-users/[email protected]/ -- 2.47.3
