Re: [PATCH v8 24/29] perf kmem: Add bounds checks to tracepoint read values

sashiko-bot
2026-04-11T07:21:59Z

Sashiko AI review found 1 potential issue(s):
- [Medium] Returning -1 for unsupported page orders or migrate types silently aborts the entire `perf` event processing loop.
--

commit 3ddfc38ea8afb79021fcd1c50f48982373408ace
Author: Ian Rogers <irogers@google.com>

perf kmem: Add bounds checks to tracepoint read values

This commit adds bounds checks for the order and migrate_type fields in
page_alloc and page_free events. It prevents out-of-bounds memory accesses
when updating the order_stats tracking array.

> diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
> --- a/tools/perf/builtin-kmem.c
> +++ b/tools/perf/builtin-kmem.c
> @@ -826,6 +826,16 @@ static int evsel__process_page_alloc_event(struct perf_sample *sample)
> .migrate_type = migrate_type,
> };
>
> + if (order >= MAX_PAGE_ORDER) {
> + pr_debug("Out-of-bounds order %u\n", order);
> + return -1;

Could returning -1 here abort the entire perf event processing loop?

On architectures like ARM64, the kernel's maximum page order can sometimes be
configured higher than 11. Since MAX_PAGE_ORDER is fixed at 11 in this file,
valid high-order allocation events might be legitimately recorded in the
trace.

If we return -1 on these events, does it completely stop the trace processing
for those architectures instead of just skipping the unsupported sample?
Would it be safer to return 0 to ignore it?

> + }
> +
> + if (migrate_type >= MAX_MIGRATE_TYPES) {
> + pr_debug("Out-of-bounds migratetype %u\n", migrate_type);
> + return -1;

Similarly, could returning -1 here cause the tool to exit prematurely if an
unexpected migrate_type is encountered?

[ ... ]
> @@ -892,6 +902,11 @@ static int evsel__process_page_free_event(struct perf_sample *sample)
> .order = order,
> };
>
> + if (order >= MAX_PAGE_ORDER) {
> + pr_debug("Out-of-bounds order %u\n", order);
> + return -1;

Would returning 0 here also be better to avoid aborting the entire session
when a free event with a large order arrives?

[ ... ]

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260411065718.372240-1-irogers@google.com?part=24