Re: [PATCH v15 3/5] perf inject/aslr: Implement sample address remapping

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Silent Drop of Entire Sample for recordings with branch counters
--

commit 626067d9ffedea6b6e512a71e2a2cb18442024b3
Author: Ian Rogers <irogers@google.com>

perf inject/aslr: Implement sample address remapping

This commit adds sample address remapping logic to the ASLR tool. It parses
sample events and remaps IPs, addresses, callchains, and branch stacks
while dropping potentially leaking information like raw and stack samples.

> diff --git a/tools/perf/util/aslr.c b/tools/perf/util/aslr.c
> --- a/tools/perf/util/aslr.c
> +++ b/tools/perf/util/aslr.c
[ ... ]
> @@ -583,13 +637,405 @@ static int aslr_tool__process_sample(const struct perf_tool *tool,
[ ... ]
> +		if (evsel->core.attr.branch_sample_type & PERF_SAMPLE_BRANCH_COUNTERS) {
> +			if (nr > max_i - i || nr > max_j - j) {
> +				ret = -EFAULT;
> +				goto out_put;
> +			}
> +			memcpy(&out_array[j], &in_array[i], nr * sizeof(u64));
> +			i += nr;
> +			j += nr;
> +			/* TODO: confirm branch counters don't leak ASLR information. */
> +			pr_debug("Dropping sample branch counters as possible ASLR leak\n");
> +			ret = 0;
> +			goto out_put;
> +		}

[Severity: High]
Does this code unintentionally drop the entire sample?

The code copies the branch counters into the new array but then immediately
executes ret = 0; goto out_put; within aslr_tool__process_sample(). This aborts
processing of the sample entirely and skips delegating the sample to the output,
dropping it completely.

Since branch_sample_type is an attribute of the event, won't this result in
all samples being silently dropped, leading to an empty output file for any
recording that includes branch counters?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260606072125.2786845-1-irogers@google.com?part=3