Re: [PATCH 2/9] perf thread-stack: Report branch stack hw_idx as not available

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Pre-existing heap buffer overflow in thread_stack__br_sample due to incorrect memcpy length.
--

--- Patch [2]: [PATCH 2/9] perf thread-stack: Report branch stack hw_idx as not available ---
commit 51033b3641484a31783c5c945c25ef5ee0bfb23e
Author: Amir Ayupov <aaupov@fb.com>

perf thread-stack: Report branch stack hw_idx as not available

This commit sets hw_idx to -1ULL for synthesised branch stacks to indicate
that the hardware index is not available. This prevents consumers from
erroneously assuming these branch stacks start at LBR TOS entry 0, matching
the behaviour of intel-pt and cs-etm.

> diff --git a/tools/perf/util/thread-stack.c b/tools/perf/util/thread-stack.c
> --- a/tools/perf/util/thread-stack.c
> +++ b/tools/perf/util/thread-stack.c
> @@ -624,6 +624,7 @@ void thread_stack__br_sample(struct thread *thread, int cpu,
>  	unsigned int nr;
>  
>  	dst->nr = 0;
> +	dst->hw_idx = -1ULL;
>  
>  	if (!ts)
>  		return;

[ ... ]

>  	if (src->nr >= ts->br_stack_sz) {
>  		sz -= nr;
>  		be = &dst->entries[nr];
>  		nr = min(ts->br_stack_pos, sz);
>  		memcpy(be, &src->entries[0], bsz * ts->br_stack_pos);

[Severity: Critical]
This is a pre-existing issue, but does this memcpy() write past the end of
the dst buffer?

We calculate nr as min(ts->br_stack_pos, sz), which limits the count
to the available size in the buffer. However, the memcpy() uses
bsz * ts->br_stack_pos instead of bsz * nr.

When running perf commands that parse Intel PT traces, ts->br_stack_sz can
be larger than the sample size sz. This could cause ts->br_stack_pos to
exceed nr, leading to a heap buffer overflow when copying to be.

>  	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803090640.2412336-1-aaupov@fb.com?part=2