Re: [PATCH v12 31/33] perf evsel: Add bounds checking to trace point raw data accessors

sashiko-bot
2026-04-13T04:56:45Z

Sashiko AI review found 1 potential issue(s):
- [Medium] The `out_of_bounds` helper uses `pr_warning()` instead of a rate-limited logging function, which will cause a denial of service (console flooding) when processing malformed trace data.
--

commit f063887da379b6999ed28dc220458791de834acf
Author: Ian Rogers <irogers@google.com>

perf evsel: Add bounds checking to trace point raw data accessors

This commit adds bounds checking to prevent tracepoint fields from reading
out of bounds. It also fixes handling of dynamic tracepoint fields when
endianness varies by byte swapping the data.

> diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
> index bb48568b8101a..713a250c73740 100644
> --- a/tools/perf/util/evsel.c
> +++ b/tools/perf/util/evsel.c
> @@ -3700,22 +3700,63 @@ struct tep_format_field *evsel__common_field(struct evsel *evsel, const char *na
> return tp_format ? tep_find_common_field(tp_format, name) : NULL;
> }
>
> +static bool out_of_bounds(const struct tep_format_field *field, int offset, int size, u32 raw_size)
> +{
> + if (offset < 0) {
> + pr_warning("Negative trace point field offset %d in %s\n",
> + offset, field->name);
> + return true;
> + }
> + if (size < 0) {
> + pr_warning("Negative trace point field size %d in %s\n",
> + size, field->name);
> + return true;
> + }
> + if ((u32)offset + (u32)size > raw_size) {
> + pr_warning("Out of bound tracepoint field (%s) offset %d size %d in %u\n",
> + field->name, offset, size, raw_size);

Could this cause console flooding if the trace data is malformed?

Since perf_sample__rawptr() and format_field__intval() are called per-field
for every sample in the trace, and a typical perf.data file can contain
millions of samples, using unconditional logging like pr_warning() might flood
the console.

Would it be better to use a rate-limited or once-per-run logging function
such as pr_warning_once() here to avoid making the tool unresponsive?

> + return true;
> + }
> + return false;
> +}

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260413041143.1736055-1-irogers@google.com?part=31