Re: [PATCH 15/29] perf session: Add byte-swap and bounds check for PERF_RECORD_BPF_METADATA events

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Re-fetching `event->header.size` in `perf_session__process_user_event` bypasses core bounds validation, leading to out-of-bounds reads.
--

commit a969bd48aeaaebd10cf33ba371bb6523a1e2faf9
Author: Arnaldo Carvalho de Melo <acme@redhat.com>
Subject: perf session: Add byte-swap and bounds check for PERF_RECORD_BPF_METADATA events

This commit adds a byte-swap handler for PERF_RECORD_BPF_METADATA events to
handle cross-endian perf.data files. It also adds bounds checking and string
termination validation to prevent out-of-bounds reads during downstream
processing.

> diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
> index f6ce36f515207..ec7da1e1a00f7 100644
> --- a/tools/perf/util/session.c
> +++ b/tools/perf/util/session.c
[ ... ]
> @@ -2192,9 +2235,53 @@ static s64 perf_session__process_user_event(struct perf_session *session,
>  	case PERF_RECORD_FINISHED_INIT:
>  		err = tool->finished_init(tool, session, event);
>  		break;
> -	case PERF_RECORD_BPF_METADATA:
> +	case PERF_RECORD_BPF_METADATA: {
> +		u64 nr_entries, max_entries;
> +		u32 hdr_size = READ_ONCE(event->header.size);

[Severity: Medium]
Can re-fetching event->header.size here bypass the core bounds validation?

The core event processing loop validates that the event fits within the memory
mapped region using the initial fetch of the size field. Because native-endian
files are mapped using MAP_SHARED, the memory can be modified concurrently if
the file is shared or backed by a FUSE filesystem.

By re-fetching the size via READ_ONCE(event->header.size) after the initial
validation, a concurrent modification could inflate hdr_size. This artificially
inflates the max_entries calculation beyond the actual memory bounds of the
mmap, which could lead to out-of-bounds reads during the strnlen() loop and
potentially cause a segmentation fault.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260524032709.1080771-1-acme@kernel.org?part=15