Re: [PATCH 15/28] perf header: Validate null-termination in PERF_RECORD_EVENT_UPDATE string fields

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing payload bounds validation for the PERF_CPU_MAP__MASK variant in perf_event__fprintf_event_update() allows out-of-bounds reads during dump_trace.
--

commit ae463885b1ae6653d958a99e1d8f5f34ac03cf41
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf header: Validate null-termination in PERF_RECORD_EVENT_UPDATE string fields

This commit validates null-termination for PERF_RECORD_EVENT_UPDATE string
fields. It also hardens the event_update handlers by adding size validation
for SCALE and CPUS events and swapping CPUS variant fields so the
processing path sees native byte order.

> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index f2198ab0defd5..d253063b581f2 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c

[ ... ]

> @@ -5117,24 +5117,65 @@ size_t perf_event__fprintf_event_update(union perf_event *event, FILE *fp)

[ ... ]

> -	case PERF_EVENT_UPDATE__CPUS:
> +	case PERF_EVENT_UPDATE__CPUS: {
> +		size_t cpus_off = offsetof(struct perf_record_event_update, cpus);
> +		u32 cpus_payload;
> +
> +		if (event->header.size < cpus_off + sizeof(__u16) +
> +					 sizeof(struct perf_record_range_cpu_map)) {
> +			ret += fprintf(fp, "... cpus: (truncated)\n");
> +			break;
> +		}
> +
> +		/*
> +		 * Validate nr against payload — this function may be
> +		 * called from the stub handler (dump_trace path) which
> +		 * bypasses perf_event__process_event_update() validation.
> +		 */
> +		cpus_payload = event->header.size - cpus_off;
> +		if (ev->cpus.cpus.type == PERF_CPU_MAP__CPUS &&
> +		    ev->cpus.cpus.cpus_data.nr >
> +		    (cpus_payload - offsetof(struct perf_record_cpu_map_data, cpus_data.cpu)) /
> +		    sizeof(ev->cpus.cpus.cpus_data.cpu[0])) {
> +			ret += fprintf(fp, "... cpus: nr %u exceeds payload\n",
> +				       ev->cpus.cpus.cpus_data.nr);
> +			break;
> +		}
> +
>  		ret += fprintf(fp, "... ");
>  
>  		map = cpu_map__new_data(&ev->cpus.cpus);

Could this missing validation for PERF_CPU_MAP__MASK variants introduce an
out-of-bounds read regression when tracing?

If the event type is PERF_CPU_MAP__MASK, the validation block added here only
checks for PERF_CPU_MAP__CPUS. The mask variant would skip the payload checks
and proceed directly to cpu_map__new_data() with unvalidated event data.

Since the comment notes that this dump_trace path bypasses the deeper checks
found in perf_event__process_event_update(), would it be safer to also
include the mask variant checks here to ensure the nr field doesn't exceed
the payload size?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260510033424.255812-1-acme@kernel.org?part=15