Re: [PATCH v10 24/29] perf kmem: Add bounds checks to tracepoint read values

sashiko-bot
2026-04-12T02:29:54Z

Sashiko AI review found 1 potential issue(s):
- [Medium] Returning -1 for page orders >= MAX_PAGE_ORDER abruptly aborts the perf session, breaking `perf kmem` for valid traces from architectures with larger page orders.
--

commit 343c06e69ee85027cceea5dae68c1cbbcd37a663
Author: Ian Rogers <irogers@google.com>

perf kmem: Add bounds checks to tracepoint read values

This commit adds bounds checking for order and migrate_type in
page_alloc_event and page_free_event to avoid out-of-bounds memory accesses.

> diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
> index daf2272c73372..33585e353efe5 100644
> --- a/tools/perf/builtin-kmem.c
> +++ b/tools/perf/builtin-kmem.c
> @@ -826,6 +826,16 @@ static int evsel__process_page_alloc_event(struct perf_sample *sample)
> .migrate_type = migrate_type,
> };
>
> + if (order >= MAX_PAGE_ORDER) {
> + pr_debug("Out-of-bounds order %u\n", order);
> + return -1;
> + }

Is returning -1 the desired behavior here?

MAX_PAGE_ORDER is hardcoded to 11 in tools/perf/builtin-kmem.c. However,
several architectures legitimately support larger maximum page orders. For
instance, ARM64 with 64K pages defaults to ARCH_FORCE_MAX_ORDER = 13,
meaning valid traces can contain allocation events with order >= 11.

Returning a negative value from an event callback causes
perf_session__process_events() to stop processing and abort the entire
session. This prevents the out-of-bounds array access but makes perf kmem
completely unusable for valid traces from these architectures.

Would it be better to return 0 to simply skip the unprocessable event
without aborting the entire parsing session?

[ ... ]

> @@ -892,6 +902,11 @@ static int evsel__process_page_free_event(struct perf_sample *sample)
> .order = order,
> };
>
> + if (order >= MAX_PAGE_ORDER) {
> + pr_debug("Out-of-bounds order %u\n", order);
> + return -1;
> + }

Does this have the same issue as above where returning -1 aborts the
session for valid traces with higher page orders?

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260412020833.641177-1-irogers@google.com?part=24