Re: [PATCH 06/11] perf sched: Bounds-check prio before test_bit() in timehist

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Logic inversion in priority bounds check breaks --prio filtering for initial events.
--

commit 1cea9987d6681e3cb6b64fbd144fd651abc72351
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf sched: Bounds-check prio before test_bit() in timehist

This commit adds bounds checking for the priority variable in
timehist_skip_sample to prevent out-of-bounds memory accesses in
test_bit. It attempts to skip samples if the priority falls outside the
valid range.

> diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
> index 1ff01f03d2ad1..5f3510f9ca249 100644
> --- a/tools/perf/builtin-sched.c
> +++ b/tools/perf/builtin-sched.c

[ ... ]

> @@ -2645,7 +2645,9 @@ static bool timehist_skip_sample(struct perf_sched *sched,
>  		else if (evsel__name_is(sample->evsel, "sched:sched_switch"))
>  			prio = perf_sample__intval(sample, "prev_prio");
>  
> -		if (prio != -1 && !test_bit(prio, sched->prio_bitmap)) {
> +		/* prio comes from untrusted tracepoint data — skip invalid values */
> +		if (prio < 0 || prio >= MAX_PRIO ||
> +		    !test_bit(prio, sched->prio_bitmap)) {

[Severity: Medium]
Does this logic inversion unintentionally skip valid initial events that do
not have their priority recorded yet?

In timehist_skip_sample(), prio is initialized to -1 to represent an
unknown priority:

    int prio = -1;

With the previous logic, an unknown priority of -1 caused the condition to
evaluate to false, allowing the event to pass the filter:

    if (prio != -1 && !test_bit(prio, sched->prio_bitmap)) {
        rc = true;
        sched->skipped_samples++;
    }

With the new logic, the condition prio < 0 evaluates to true when prio is -1,
causing the event to be unexpectedly skipped.

>  			rc = true;
>  			sched->skipped_samples++;
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260607232925.1935819-1-acme@kernel.org?part=6