Re: [RESEND Patch v10 12/23] perf: Add sampling support for SIMD registers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unbounded or improperly ordered SIMD register sample size calculation causes a `u16` size overflow in `perf_event_header.size`, leading to ring buffer memory corruption.
--

--- Patch [12]: [RESEND Patch v10 12/23] perf: Add sampling support for SIMD registers ---
commit e9a1c0bea3274c1464a1ceda195d11e8cdb5abe5
Author: Kan Liang <kan.liang@linux.intel.com>
perf: Add sampling support for SIMD registers

This patch introduces new attribute fields in struct perf_event_attr to
specify and retrieve SIMD registers during profiling. It also adds the
PERF_SAMPLE_REGS_ABI_SIMD flag and a new output format to indicate the
configuration and contents of these wider registers when sampled.

> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 801cf34cf519b..6cc655e7694d4 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
[ ... ]
> @@ -8775,6 +8866,10 @@ void perf_prepare_sample(struct perf_sample_data *data,
>  			u64 mask = event->attr.sample_regs_intr;
>  
>  			size += hweight64(mask) * sizeof(u64);
> +			if (event_has_simd_regs(event)) {
> +				size += perf_update_xregs_size(event, true);
> +				data->regs_intr.abi |= PERF_SAMPLE_REGS_ABI_SIMD;
> +			}
>  		}
>  
>  		data->dyn_size += size;

[Severity: High]
This is a pre-existing issue, but does adding potentially large SIMD
registers here guarantee an overflow of the 16-bit event size?

Looking at perf_prepare_sample() in kernel/events/core.c,
PERF_SAMPLE_STACK_USER is processed before this and maximizes the stack
dump size to fit within U16_MAX. By appending the size of SIMD registers
(which could be up to 32KB) after the stack truncation step, the total
dyn_size can easily exceed 65535 bytes if a user configures a perf event
with both PERF_SAMPLE_STACK_USER (requesting near 64KB) and
PERF_SAMPLE_REGS_INTR with SIMD registers enabled.

When perf_prepare_header() later writes the total size to header->size,
the value will be silently truncated because header->size is a u16. Can
this lead to the kernel writing more data than it reserved, causing ring
buffer memory corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824082731.1013973-1-dapeng1.mi@linux.intel.com?part=12