Re: [PATCH v9 5/5] perf aslr: Strip sample registers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] Allocating `stripped_event` using unvalidated `event->header.size` and unconditionally writing to `sample_regs_user` and `sample_regs_intr` causes a severe heap buffer overflow.
- [High] Missing register stripping in the `itrace`-enabled path of `perf_event__repipe_attr` corrupts the trace output.
--

commit 5f1dabd94a15919e76927871536447a8782dba24
Author: Ian Rogers <irogers@google.com>

perf aslr: Strip sample registers

Refactor the ASLR tool to strip out only the register dump payload
by masking out the relevant perf_event_attr fields when the delegated
tool is handling the data. struct aslr_evsel_priv maintains the
original perf_event_attr values and is looked up via the evsel_orig_attrs
hashmap.

> diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
> index a9f0a3901e7bc..e0f59ef8b97b2 100644
> --- a/tools/perf/builtin-inject.c
> +++ b/tools/perf/builtin-inject.c
> @@ -253,6 +253,8 @@ static int perf_event__repipe_attr(const struct perf_tool *tool,
>  				return -ENOMEM;
>  			memcpy(stripped_event, event, event->header.size);
>  			stripped_event->attr.attr.sample_type &= ASLR_SUPPORTED_SAMPLE_TYPE;
> +			stripped_event->attr.attr.sample_regs_user = 0;
> +			stripped_event->attr.attr.sample_regs_intr = 0;

[Severity: Critical]
Can this write out of bounds and corrupt the heap?

In perf_event__repipe_attr(), stripped_event is allocated using
event->header.size. For older perf.data formats (like PERF_ATTR_SIZE_VER0),
the size can be as small as 72 bytes.

However, sample_regs_user and sample_regs_intr are at offsets 88 and 104 in
the perf_event_attr structure. Writing to these fields unconditionally on a
72-byte allocation will corrupt the heap when processing older traces.

[Severity: High]
Also in perf_event__repipe_attr(), when itrace_synth_opts.set is true,
should the register bits and masks be cleared from the synthesized attr?

When --itrace and --aslr are used together in pipe mode, the code branches to
the itrace_synth_opts.set path in perf_event__repipe_attr():

perf_event__repipe_attr() {
    ...
    if (!inject->itrace_synth_opts.set) {
        /* registers are stripped in this branch */
    }
    ...
    attr.sample_type &= ~PERF_SAMPLE_AUX;
    if (inject->aslr)
        attr.sample_type &= ASLR_SUPPORTED_SAMPLE_TYPE;
    /* register clearing is missing here */
    ...
    perf_event__synthesize_attr(...)
}

This patch strips the repiped samples of their register payloads via
aslr_tool__process_sample(), but the itrace path above leaves the register
flags in the attr event.

This mismatch between the attr event and the payload can corrupt the output
pipe trace and cause parsers to fail.

>  			if (stripped_event->attr.attr.type == PERF_TYPE_BREAKPOINT)
>  				stripped_event->attr.attr.bp_addr = 0;

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604172850.683329-1-irogers@google.com?part=5