All of lore.kernel.org
 help / color / mirror / Atom feed
From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: sashiko-reviews@lists.linux.dev
Cc: linux-perf-users@vger.kernel.org
Subject: Re: [PATCH 01/27] perf session: Add minimum event size and alignment validation
Date: Thu, 21 May 2026 10:01:42 -0300	[thread overview]
Message-ID: <ag8CNsomAdrEF02X@x1> (raw)
In-Reply-To: <20260521015919.702051F000E9@smtp.kernel.org>

On Thu, May 21, 2026 at 01:59:19AM +0000, sashiko-bot@kernel.org wrote:
> Pre-existing issues:
> - [High] `perf_session__process_event` returns `event->header.size` for unknown event types, causing the stream reader to skip double the event size.

> >  
> >  	if (event->header.type >= PERF_RECORD_HEADER_MAX) {
> >  		/* This perf is outdated and does not support the latest event type. */
> >  		ui__warning("Unsupported header type %u, please consider updating perf.\n",
> >  			    event->header.type);
> > -		return -EINVAL;
> > -
> > +		/* Skip unsupported event by returning its size. */
> > +		return event->header.size;
> >  	}
 
> [Severity: High]
> This is a pre-existing issue, but does returning event->header.size for
> unknown event types cause the stream reader to skip too far?
 
> When the caller reader__read_event() initializes size = event->header.size
> and adds the positive return value (skip), it causes the reader to advance
> by 2 * event->header.size.
 
> Could this misalign the stream and break parsing for the rest of the file?

Will be addressed in v2.

- Arnaldo

  reply	other threads:[~2026-05-21 13:01 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-21  1:09 [PATCHES 00/27] perf.data validation and hardening Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 01/27] perf session: Add minimum event size and alignment validation Arnaldo Carvalho de Melo
2026-05-21  1:59   ` sashiko-bot
2026-05-21 13:01     ` Arnaldo Carvalho de Melo [this message]
2026-05-21  1:09 ` [PATCH 02/27] perf tools: Fix event_contains() macro to verify full field extent Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 03/27] perf zstd: Fix compression error path in zstd_compress_stream_to_records() Arnaldo Carvalho de Melo
2026-05-21  1:49   ` sashiko-bot
2026-05-21  1:09 ` [PATCH 04/27] perf zstd: Fix multi-iteration decompression and error handling Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 05/27] perf session: Fix PERF_RECORD_READ swap and dump for variable-length events Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 06/27] perf session: Fix swap_sample_id_all() crash on crafted events Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 07/27] perf session: Add validated swap infrastructure with null-termination checks Arnaldo Carvalho de Melo
2026-05-21  1:52   ` sashiko-bot
2026-05-21  1:09 ` [PATCH 08/27] perf session: Use bounded copy for PERF_RECORD_TIME_CONV Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 09/27] perf session: Validate HEADER_ATTR attr.size before swapping Arnaldo Carvalho de Melo
2026-05-21  2:04   ` sashiko-bot
2026-05-21  1:09 ` [PATCH 10/27] perf session: Validate nr fields against event size on both swap and common paths Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 11/27] perf header: Byte-swap build ID event pid and bounds check section entries Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 12/27] perf cpumap: Reject RANGE_CPUS with start_cpu > end_cpu Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 13/27] perf auxtrace: Harden auxtrace_error event handling Arnaldo Carvalho de Melo
2026-05-21  1:09 ` [PATCH 14/27] perf session: Add byte-swap and bounds check for PERF_RECORD_BPF_METADATA events Arnaldo Carvalho de Melo
2026-05-21  2:23   ` sashiko-bot
2026-05-21  1:10 ` [PATCH 15/27] perf header: Validate null-termination in PERF_RECORD_EVENT_UPDATE string fields Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 16/27] perf tools: Bounds check perf_event_attr fields against attr.size before printing Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 17/27] perf header: Propagate feature section processing errors Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 18/27] perf header: Validate f_attr.ids section before use in perf_session__read_header() Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 19/27] perf header: Validate feature section size and add read path bounds checking Arnaldo Carvalho de Melo
2026-05-21  2:34   ` sashiko-bot
2026-05-21  1:10 ` [PATCH 20/27] perf header: Sanity check HEADER_EVENT_DESC attr.size before swap Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 21/27] perf header: Validate bitmap size before allocating in do_read_bitmap() Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 22/27] perf session: Add byte-swap for PERF_RECORD_COMPRESSED2 events Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 23/27] perf tools: Harden compressed event processing Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 24/27] perf session: Check for decompression buffer size overflow Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 25/27] perf session: Bound nr_cpus_avail and validate sample CPU Arnaldo Carvalho de Melo
2026-05-21  2:43   ` sashiko-bot
2026-05-21  1:10 ` [PATCH 26/27] perf kwork: Bounds check work->cpu before indexing cpus_runtime[] Arnaldo Carvalho de Melo
2026-05-21  1:10 ` [PATCH 27/27] perf test: Add truncated perf.data robustness test Arnaldo Carvalho de Melo
2026-05-21  2:07   ` sashiko-bot
2026-05-21 12:57     ` Arnaldo Carvalho de Melo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ag8CNsomAdrEF02X@x1 \
    --to=acme@kernel.org \
    --cc=linux-perf-users@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.