Re: [PATCH v1 1/9] perf evsel: Clamp sample_id size for ksymbol, bpf, and text_poke events

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] perf evsel: Incorrect PERF_RECORD_TEXT_POKE payload size calculation
--

commit fc6474e9b3305fb280e04ce2b30b2a815e2f3a7e
Author: Ian Rogers <irogers@google.com>

perf evsel: Clamp sample_id size for ksymbol, bpf, and text_poke events

This commit adds evsel__event_size() to clamp the effective size used to
locate the trailing id_sample for specific events. This prevents user-space
tools from reading uninitialized memory when processing data from unpatched
kernels.

Link: https://lore.kernel.org/r/20260929014206.4175245-1-irogers@google.com

> diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
> index 3367242c57640..70da6be798cca 100644
> --- a/tools/perf/util/evsel.c
> +++ b/tools/perf/util/evsel.c

[ ... ]

> @@ -3966,6 +3966,63 @@ u16 evsel__id_hdr_size(const struct evsel *evsel)
>  	return size;
>  }
>  
> +/*
> + * Prior to kernel fix, perf_event_ksymbol_output(), perf_event_bpf_output(),

[ ... ]

> +	case PERF_RECORD_TEXT_POKE: {
> +		size_t fixed = offsetof(struct perf_record_text_poke_event, bytes);
> +
> +		if (size < fixed)
> +			return size;
> +		payload = fixed + PERF_ALIGN((size_t)event->text_poke.old_len +
> +					     event->text_poke.new_len, sizeof(u64));

[Severity: Medium]
Does this misapply the 8-byte alignment only to the variable lengths rather
than the entire structure?

The kernel generates PERF_RECORD_TEXT_POKE events by padding the entire
event size to an 8-byte boundary. The payload size before id_sample is
16 + ALIGN(old_len + new_len + 4, 8).

This calculates the user-space payload as
fixed + PERF_ALIGN(old_len + new_len, 8), where fixed = 20. Because 20 is
not a multiple of 8, adding it outside the alignment yields a mathematically
incorrect size.

For example, if old_len = 1 and new_len = 1, the kernel calculates 24 bytes,
but the code here calculates 28 bytes. Calculating the wrong payload size
causes perf to index incorrectly into event->sample.array, leading to parsing
failures or out-of-bounds accesses.

> +		break;
> +	}
> +	default:
> +		return size;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929021913.56010-1-irogers@google.com?part=1