Re: [PATCH v2 2/3] perf hisi-ptt: Strengthen auxtrace event handling and packet type detection

[sashiko-bot@kernel.org]

> Fix pre-existing robustness issues in the hisi-ptt auxtrace decoder
> reported by Sashiko:
> 
> 1. Endianness in hisi_ptt_check_packet_type(): The first 32-bit word was
> read with a host-endian memory cast (*(uint32_t *)buf). On big-endian
> hosts analyzing a little-endian trace, the bit[31:11] 8DW magic check
> fails and every 8DW packet is misclassified as 4DW. Read the header
> with get_unaligned_le32().
> 
> 2. Heap out-of-bounds read: hisi_ptt_dump() called
> hisi_ptt_check_packet_type() which dereferenced 4 bytes of the buffer
> without any size check. A malformed or truncated event with
> auxtrace.size in {0,1,2,3} may cause a heap OOB read. Pass the buffer
> length to hisi_ptt_check_packet_type() and return (defaulting to
> 4DW) when the buffer is shorter than HISI_PTT_FIELD_LENTH.
> 
> 3. Integer truncation: event->auxtrace.size is __u64 but was stored in
> an int. Traces larger than 2GB became negative (malloc failure), and
> huge sizes wrapping to a small positive caused a short readn() that
> left unread payload in the pipe and permanently desynchronized the
> stream. Use u64 for the size, reject anything larger than SSIZE_MAX
> before malloc (same bound used by auxtrace_copy_data()), and compare
> readn()'s return value against (ssize_t)size to detect truncation.
> 
> Signed-off-by: Sizhe Liu <liusizhe5@huawei.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260730062709.534139-1-liusizhe5@huawei.com?part=2