Re: [PATCH v14 3/5] perf inject/aslr: Implement sample address remapping

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Double-swapping of branch stack flags on cross-endian hosts corrupts output file branch metadata.
--

commit dcb8e448dca91e01727a6cd53948bd906dde4043
Author: Ian Rogers <irogers@google.com>

perf inject/aslr: Implement sample address remapping

This commit adds sample address remapping logic to the ASLR tool. It parses
sample events, remaps IPs, addresses, callchains, and branch stacks, and
filters out potential leak sources like raw samples.

> diff --git a/tools/perf/util/aslr.c b/tools/perf/util/aslr.c
> --- a/tools/perf/util/aslr.c
> +++ b/tools/perf/util/aslr.c

[ ... ]

> @@ -560,13 +614,400 @@ static int aslr_tool__process_sample(const struct perf_tool *tool,

[ ... ]

> +	if (sample_type & PERF_SAMPLE_BRANCH_STACK) {

[ ... ]

> +		for (u64 cntr = 0; cntr < nr; cntr++) {
> +			out_array[j++] = aslr_tool__remap_address(aslr, thread,
> +								  sample->cpumode,
> +								  in_array[i++]); /* from */
> +			out_array[j++] = aslr_tool__remap_address(aslr, thread,
> +								  sample->cpumode,
> +								  in_array[i++]); /* to */
> +			out_array[j++] = in_array[i++]; /* flags */
> +		}

[ ... ]

> +	new_event->sample.header.size = sizeof(struct perf_event_header) + j * sizeof(u64);
> +
> +	perf_sample__init(&new_sample, /*all=*/ true);
> +	ret = evsel__parse_sample(evsel, new_event, &new_sample);

[Severity: Medium]
On cross-endian hosts, does calling evsel__parse_sample() here corrupt the
branch stack flags?

The initial pipeline already called evsel__parse_sample() on the original
event, which performs an in-place bitfield swap on the branch stack flags
to match the host layout when evsel->needs_swap is true.

When aslr_tool__process_sample() copies these already-swapped flags into
the new event array and then calls evsel__parse_sample() a second time on
the new event, won't this trigger the in-place bitfield swap again?

This double-swap would revert the flags back to the file endianness layout
within a host-endian output file, potentially corrupting branch stack
metadata (like mispredicts or cycles) for downstream tools.

> +
> +	if (ret) {
> +		perf_sample__exit(&new_sample);
> +		goto out_put;
> +	}
> +
> +	new_sample.evsel = evsel;
> +	ret = delegate->sample(delegate, new_event, &new_sample, machine);
> +	perf_sample__exit(&new_sample);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605205649.2566948-1-irogers@google.com?part=3