Re: [PATCH v11 28/33] perf kmem: Add bounds checks to tracepoint read values

sashiko-bot
2026-04-13T01:47:10Z

Sashiko AI review found 1 potential issue(s):
- [Medium] The expression `kmem_page_size << order` is evaluated before the bounds check on `order`, leading to undefined behavior for large values.
--

commit ca9443054d9f6f035d544a17db70ef586c3b3ae2
Author: Ian Rogers <irogers@google.com>

perf kmem: Add bounds checks to tracepoint read values

This commit adds bounds checking for order and migrate_type in page
allocation and free events to prevent out-of-bounds array accesses.

> diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
> --- a/tools/perf/builtin-kmem.c
> +++ b/tools/perf/builtin-kmem.c
> @@ -826,6 +826,16 @@ static int evsel__process_page_alloc_event(struct perf_sample *sample)
> {
> u64 page;
> unsigned int order = perf_sample__intval(sample, "order");
> unsigned int gfp_flags = perf_sample__intval(sample, "gfp_flags");
> unsigned int migrate_type = perf_sample__intval(sample, "migratetype");
> u64 bytes = kmem_page_size << order;

Could this bitwise shift invoke undefined behavior if a malformed event
provides an order value larger than the bit width of kmem_page_size?

> u64 callsite;
> struct page_stat *pstat;
> struct page_stat this = {
> .order = order,
> .gfp_flags = gfp_flags,
> .migrate_type = migrate_type,
> };
>
> + if (order >= MAX_PAGE_ORDER) {
> + pr_debug("Out-of-bounds order %u\n", order);
> + return -1;
> + }

Since the bounds check on order happens down here, would it be safer to
move the calculation of bytes until after the validation?

[ ... ]

> @@ -892,6 +902,11 @@ static int evsel__process_page_free_event(struct perf_sample *sample)
> {
> u64 page;
> unsigned int order = perf_sample__intval(sample, "order");
> u64 bytes = kmem_page_size << order;

Does this have the same evaluation issue, where a corrupted order value
could cause an invalid shift before reaching the bounds check?

> struct page_stat *pstat;
> struct page_stat this = {
> .order = order,
> };
>
> + if (order >= MAX_PAGE_ORDER) {
> + pr_debug("Out-of-bounds order %u\n", order);
> + return -1;
> + }
>
> if (use_pfn)
> page = perf_sample__intval(sample, "pfn");

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260413012227.1089445-1-irogers@google.com?part=28