Re: [RESEND Patch v10 12/23] perf: Add sampling support for SIMD registers

["Mi, Dapeng" <dapeng1.mi@linux.intel.com>]

On 8/24/2026 4:54 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] Unbounded or improperly ordered SIMD register sample size calculation causes a `u16` size overflow in `perf_event_header.size`, leading to ring buffer memory corruption.
> --
>
> --- Patch [12]: [RESEND Patch v10 12/23] perf: Add sampling support for SIMD registers ---
> commit e9a1c0bea3274c1464a1ceda195d11e8cdb5abe5
> Author: Kan Liang <kan.liang@linux.intel.com>
> perf: Add sampling support for SIMD registers
>
> This patch introduces new attribute fields in struct perf_event_attr to
> specify and retrieve SIMD registers during profiling. It also adds the
> PERF_SAMPLE_REGS_ABI_SIMD flag and a new output format to indicate the
> configuration and contents of these wider registers when sampled.
>
>> diff --git a/kernel/events/core.c b/kernel/events/core.c
>> index 801cf34cf519b..6cc655e7694d4 100644
>> --- a/kernel/events/core.c
>> +++ b/kernel/events/core.c
> [ ... ]
>> @@ -8775,6 +8866,10 @@ void perf_prepare_sample(struct perf_sample_data *data,
>>  			u64 mask = event->attr.sample_regs_intr;
>>  
>>  			size += hweight64(mask) * sizeof(u64);
>> +			if (event_has_simd_regs(event)) {
>> +				size += perf_update_xregs_size(event, true);
>> +				data->regs_intr.abi |= PERF_SAMPLE_REGS_ABI_SIMD;
>> +			}
>>  		}
>>  
>>  		data->dyn_size += size;
> [Severity: High]
> This is a pre-existing issue, but does adding potentially large SIMD
> registers here guarantee an overflow of the 16-bit event size?
>
> Looking at perf_prepare_sample() in kernel/events/core.c,
> PERF_SAMPLE_STACK_USER is processed before this and maximizes the stack
> dump size to fit within U16_MAX. By appending the size of SIMD registers
> (which could be up to 32KB) after the stack truncation step, the total
> dyn_size can easily exceed 65535 bytes if a user configures a perf event
> with both PERF_SAMPLE_STACK_USER (requesting near 64KB) and
> PERF_SAMPLE_REGS_INTR with SIMD registers enabled.
>
> When perf_prepare_header() later writes the total size to header->size,
> the value will be silently truncated because header->size is a u16. Can
> this lead to the kernel writing more data than it reserved, causing ring
> buffer memory corruption?

The next patch "perf/x86: Support XMM sampling using sample_simd_vec_reg_*
fields" would add extra check for the extended register size, it would
ensure the extended register size won't exceed U16_MAX / 2. Thanks.

    size = sizeof(u64) * 4;
    size += (hweight64(vec_mask) * vec_qwords +
         hweight32(pred_mask) * pred_qwords) * sizeof(u64);
    /*
     * INTR_REGS and USR_REGS could be sampled simultaneously,
     * so roughly restrict the size to half of U16_MAX.
     */
    if (size >= U16_MAX / 2)
        return -EINVAL;


>