Re: [PATCH v13 2/5] perf inject/aslr: Add ASLR tool infrastructure and MMAP tracking

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Calling `perf_env__kernel_is_64_bit()` with a NULL `env` pointer in `aslr_tool__findnew_mapping()` causes an immediate crash when processing mmap events.
--

commit 8bfb4707677f93e242641f872dc50c16c412d50e
Author: Ian Rogers <irogers@google.com>

perf inject/aslr: Add ASLR tool infrastructure and MMAP tracking

This patch adds an --aslr option to perf inject to remap virtual addresses
and drop data/events to prevent leaking ASLR information. It implements
remapping and tracking for metadata events.

> diff --git a/tools/perf/util/aslr.c b/tools/perf/util/aslr.c
> new file mode 100644
> index 0000000000000..5a002dcecb8f1
> --- /dev/null
> +++ b/tools/perf/util/aslr.c
[ ... ]
> +static u64 aslr_tool__findnew_mapping(struct aslr_tool *aslr,
> +				      struct thread *aslr_thread,
> +				      u8 cpumode, u64 start,
> +				      u64 len, u64 pgoff)
> +{
[ ... ]
> +	} else {
> +		/* First address of the process, allocate key and first top address. */
> +		struct top_addresses_key *tk;
> +		struct process_top_address *top_val;
> +		struct machine *machine = remap_key.machine;
> +		struct perf_env *env = machine ? machine->env : NULL;
> +		u64 kernel_start_addr = perf_env__kernel_is_64_bit(env) ?
> +					kernel_space_start_64 : kernel_space_start_32;

[Severity: Medium]
Will this crash if env is NULL?

If machine->env is NULL, env is assigned NULL. Passing it to
perf_env__kernel_is_64_bit() will unconditionally dereference it:

tools/perf/util/env.c:perf_env__kernel_is_64_bit() {
	if (env->kernel_is_64_bit == -1)
		perf_env__init_kernel_mode(env);
	...
}

Because machines__init() leaves the host machine's env pointer as NULL,
could this cause a segmentation fault when processing the first mapped event?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605194851.2533568-1-irogers@google.com?part=2