Re: [PATCH 4/5] perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()

> From: Arnaldo Carvalho de Melo <[email protected]>
> 
> dso_cache__memcpy() computes cache_offset = offset - cache->offset,
> then cache_size = min(cache->size - cache_offset, size).  The RB tree
> lookup in __dso_cache__find() matches using the full
> DSO__DATA_CACHE_SIZE window, but cache->size reflects the actual pread
> return value from dso_cache__populate().
> 
> A short pread (e.g. near end-of-file) makes cache->size smaller than
> DSO__DATA_CACHE_SIZE.  If a subsequent access targets an offset past
> cache->offset + cache->size but within the DSO__DATA_CACHE_SIZE
> window, the cache entry is found but cache_offset exceeds cache->size.
> Since both are u64, the subtraction cache->size - cache_offset wraps
> to a large value, min() selects the caller's size, and memcpy reads
> out of bounds.
> 
> Return 0 for an offset past the valid cached data.  For a regular
> file a short pread only happens at end-of-file, so 0 is what a direct
> pread() at that offset would return: cached_io() stops its read loop
> as on EOF.  Re-reading from the backing file would not help — a
> second pread at the same offset returns the same short count.
> 
> Fixes: 366df72657e0 ("perf dso: Refactor dso_cache__read()")
> Reported-by: sashiko-bot <[email protected]>
> Cc: Adrian Hunter <[email protected]>
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4