Re: [PATCH v12 16/33] perf sched: Don't pass evsel with sample

sashiko-bot
2026-04-13T04:38:52Z

Sashiko AI review found 1 potential issue(s):
- [High] process_sched_switch_event() accesses the `sched->curr_pid` array using `sample->cpu` without verifying it against MAX_CPUS.
--

commit f56857eae8b9831a72ae998ca1a45fc0585d8ad9
Author: Ian Rogers <irogers@google.com>

perf sched: Don't pass evsel with sample

This patch simplifies the event handler signatures in perf sched by
removing the evsel argument. The sample structure already contains a
pointer to the evsel, making it unnecessary to pass both.

> diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
> index aea14bff7e61c..45439e2af8ffa 100644
> --- a/tools/perf/builtin-sched.c
> +++ b/tools/perf/builtin-sched.c

[ ... ]

> static int process_sched_switch_event(const struct perf_tool *tool,
> - struct evsel *evsel,
> struct perf_sample *sample,
> struct machine *machine)
> {

[ ... ]

> if (sched->tp_handler->switch_event)
> - err = sched->tp_handler->switch_event(sched, evsel, sample, machine);
> + err = sched->tp_handler->switch_event(sched, sample, machine);
>
> sched->curr_pid[this_cpu] = next_pid;

Can an out-of-bounds access occur here if a corrupted or malicious perf.data
file supplies an arbitrary value for sample->cpu?

This is not a new issue introduced by this patch, but since sched->curr_pid
is sized to MAX_CPUS (4096), an unchecked this_cpu value allows arbitrary
memory reads and writes when parsing untrusted files.

It looks like this is addressed in the later commit "perf sched: Bounds
check CPU in sched switch events" in this patch series.

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260413041143.1736055-1-irogers@google.com?part=16