Re: [PATCH v2 6/8] perf inject: Extend perf inject to support bid_offset conversion

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] perf: strict aliasing violation via incompatible u32* cast
--

commit e992f40013df71934d4af6ea3359426fe5b0f8a1
Author: Ian Rogers <irogers@google.com>

perf inject: Extend perf inject to support bid_offset conversion

This commit adds the --sample-buildids option to perf inject, allowing it to
drop MMAP events and rewrite samples to use build IDs and offsets instead
of virtual addresses.

> diff --git a/tools/perf/util/inject_bid_offset.c b/tools/perf/util/inject_bid_offset.c
> new file mode 100644
> index 0000000000000..25e8f21a2d5aa
> --- /dev/null
> +++ b/tools/perf/util/inject_bid_offset.c
[ ... ]
> @@ -0,0 +1,680 @@
[ ... ]
> +	if (sample_type & PERF_SAMPLE_RAW) {
> +		size_t bytes = sizeof(u32) + sample->raw_size;
> +		u64 words = DIV_ROUND_UP(bytes, sizeof(u64));
> +		u32 *out_raw = (u32 *)&out_array[j];
> +
> +		if (i > max_i || words > max_i - i)
> +			goto err;
> +		out_array[j + words - 1] = 0;
> +		*out_raw = sample->raw_size;

[Severity: High]
Does this pointer cast and dereference in inject_bid_offset_tool__sample()
violate strict aliasing rules?

Since out_raw is an incompatible u32 pointer cast from the underlying u64
array, the compiler is allowed to assume the stores do not overlap. This
means the compiler can reorder the u64 store (out_array[j + words - 1] = 0)
and the u32 store (*out_raw = sample->raw_size).

If words == 1 (for example, when sample->raw_size <= 4), both assignments
target the exact same 8-byte memory region. Under type-based alias analysis,
reordering these independent stores could result in raw_size being zeroed
out, corrupting the perf data output.

This occurs when using --sample-buildids on an input perf.data file
containing events with PERF_SAMPLE_RAW. Unlike core kernel space, the tools/
directory assumes -fstrict-aliasing by default.

> +		memcpy(out_raw + 1, sample->raw_data, sample->raw_size);
> +		i += words;
> +		j += words;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002173848.3228217-1-irogers@google.com?part=6