Re: [PATCH 01/29] perf session: Add minimum event size and alignment validation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] perf_session__peek_event returns -1 for undersized events, prematurely aborting peek_events loops, whereas process_event skips them.
--

commit 8d4b5789ad1a0d60851429197cd2d50673cbbabd
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf session: Add minimum event size and alignment validation

This commit adds per-type minimum size validation for perf events before swap
and processing to prevent out-of-bounds access. It enforces 8-byte alignment
on event sizes and rejects unaligned sizes to avoid corrupting the event
stream. It also updates peek_event and process_event to handle undersized or
unknown event types.

> diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
> --- a/tools/perf/util/session.c
> +++ b/tools/perf/util/session.c
[ ... ]
> @@ -1775,52 +1881,85 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
[ ... ]
> +	if (event->header.type >= PERF_RECORD_HEADER_MAX) {
> +		pr_warning("WARNING: peek_event: unsupported event type %u, skipping\n",
> +			   event->header.type);
> +		return 0;
> +	}
>  
> -	if (event->header.size < hdr_sz || event->header.size > buf_sz)
> +	if (perf_event__too_small(event, &min_sz)) {
> +		pr_warning("WARNING: peek_event: %s event size %u too small (min %u)\n",
> +			   perf_event__name(event->header.type),
> +			   event->header.size, min_sz);
>  		return -1;
> +	}
>  
>  	if (session->header.needs_swap)
>  		event_swap(event, evlist__sample_id_all(session->evlist));

[Severity: Medium]
Does returning -1 here cause peek_event loops to prematurely abort?

In the updated perf_session__process_event logic, undersized events are
safely stepped over by returning 0, as they are 8-byte aligned and won't
desynchronize the stream.

Since callers of perf_session__peek_event typically abort entirely on any
error rather than inspecting the returned event pointer to advance, returning
-1 for an undersized event might permanently abort processing for partially
corrupted trace files. 

Should this return 0 to skip the undersized event, matching the behavior
introduced just above it for unknown event types?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525010550.1100375-1-acme@kernel.org?part=1