Re: [PATCH 24/29] perf tools: Harden compressed event processing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The validation for comp_mmap_len incorrectly rejects valid 2GB power-of-two mmap buffer sizes, breaking backward compatibility.
--

commit 7eecd6b6f6e3999d9f64b3d9ab6c2ddaff3a8a51
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf tools: Harden compressed event processing

This commit adds several hardening checks to the compressed event
decompression pipeline in perf tools. It validates decomp_last_rem
underflows, event sizes, and bounds the comp_mmap_len.

> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index 66929c5557b21..cbc740fd29e68 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c

[ ... ]

> @@ -3861,6 +3861,23 @@ static int process_compressed(struct feat_fd *ff,
>  	if (do_read_u32(ff, &(env->comp_mmap_len)))
>  		return -1;
>  
> +	/*
> +	 * FIXME: perf.data should record the recording system's page
> +	 * size — it affects mmap buffer alignment, sample addresses,
> +	 * and data_page_size/code_page_size interpretation.  Without
> +	 * it we assume 4K (the smallest Linux page size) as a safe
> +	 * minimum alignment for comp_mmap_len validation.
> +	 *
> +	 * Cap at 2 GB to keep decomp_len + decomp_last_rem +
> +	 * sizeof(struct decomp) within size_t range on 32-bit.
> +	 */
> +	if (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096 ||
> +	    env->comp_mmap_len > (2U * 1024 * 1024 * 1024 - 4096)) {

[Severity: Medium]
Will this cap reject valid 2GB mmap buffer sizes?

When a user specifies a 2GB mmap buffer, such as by using perf record -m 2G,
perf parses this as 524288 pages. The resulting mmap length calculation adds
one control page, resulting in exactly (524288 + 1) * 4096 = 2147487744 bytes.

Since 2147487744 is greater than the cap of 2147479552, it seems this check
will unconditionally reject these valid perf.data files and break backwards
compatibility for large perf sessions.

> +		pr_err("Invalid HEADER_COMPRESSED: comp_mmap_len (%u) must be a 4K-aligned value in [4096, %u]\n",
> +		       env->comp_mmap_len, 2U * 1024 * 1024 * 1024 - 4096);
> +		return -1;
> +	}
> +
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260524032709.1080771-1-acme@kernel.org?part=24