[PATCH] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check

[PATCH] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check

[Wang Yan]

min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
POWERPC_VPADTL_TYPE + 1 elements.  POWERPC_VPADTL_TYPE is the first
enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
check validates only the perf_record_auxtrace_info header itself.  A
PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
read runs one u64 past the validated region.

This is the same off-by-one fixed for Intel PT by commit c4362d5e1a5e
("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
and for Intel BTS by commit b9fb8225951c ("perf intel-bts: Fix off-by-one
in auxtrace_info minimum size check").

Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
priv index is covered by the minimum-size validation.

Fixes: c4bbd4ec2e50 ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
---
 tools/perf/util/powerpc-vpadtl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
index 710f3093f3f9..c15636eef34b 100644
--- a/tools/perf/util/powerpc-vpadtl.c
+++ b/tools/perf/util/powerpc-vpadtl.c
@@ -683,7 +683,7 @@ int powerpc_vpadtl_process_auxtrace_info(union perf_event *event,
 				  struct perf_session *session)
 {
 	struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
-	size_t min_sz = sizeof(u64) * POWERPC_VPADTL_TYPE;
+	size_t min_sz = sizeof(u64) * (POWERPC_VPADTL_TYPE + 1);
 	struct powerpc_vpadtl *vpa;
 	int err;
 
-- 
2.25.1

Re: [PATCH] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds memory read when indexing `preempt_reasons` and `dispatch_reasons` string arrays with unvalidated payload data.
- [High] Missing minimum size validation for auxtrace buffers before parsing `boottb_freq`.
- [High] Invalid `sizeof(record)` usage truncates `sample.raw_size` to 8 bytes instead of the full struct size, causing downstream out-of-bounds reads.
--

--- Patch [1]: [PATCH] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check ---
commit aa49174859e1464fdc810c66395f70e08682bd05
Author: Wang Yan <wangyan01@kylinos.cn>

perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check
    
This commit fixes an off-by-one error in auxtrace_info minimum size validation.
It correctly sizes min_sz to include the highest accessed priv index,
preventing an out-of-bounds read when validating the struct size.

Cc: stable@vger.kernel.org

> diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
> index 710f3093f3f90..c15636eef34b6 100644
> --- a/tools/perf/util/powerpc-vpadtl.c
> +++ b/tools/perf/util/powerpc-vpadtl.c
> @@ -683,7 +683,7 @@ int powerpc_vpadtl_process_auxtrace_info(union perf_event *event,
>  				  struct perf_session *session)
>  {
>  	struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
> -	size_t min_sz = sizeof(u64) * POWERPC_VPADTL_TYPE;
> +	size_t min_sz = sizeof(u64) * (POWERPC_VPADTL_TYPE + 1);
>  	struct powerpc_vpadtl *vpa;
>  	int err;
>  

tools/perf/util/powerpc-vpadtl.c:powerpc_vpadtl_dump() {
    ...
		if (dtl->timebase != 0) {
			printf("dispatch_reason:%s, preempt_reason:%s, "
					"enqueue_to_dispatch_time:%d, ready_to_enqueue_time:%d, "
					"waiting_to_ready_time:%d\n",
					dispatch_reasons[dtl->dispatch_reason],
					preempt_reasons[dtl->preempt_reason],
					be32_to_cpu(dtl->enqueue_to_dispatch_time),
					be32_to_cpu(dtl->ready_to_enqueue_time),
					be32_to_cpu(dtl->waiting_to_ready_time));
		} else {
    ...
}

[Severity: High]
This isn't a bug introduced by this patch, but can we read out-of-bounds
memory here?

The dispatch_reasons and preempt_reasons arrays have sizes 11 and 10
respectively. If the untrusted payload contains byte values that exceed these
bounds, it looks like they are used as array indices without validation.


tools/perf/util/powerpc-vpadtl.c:powerpc_vpadtl_decode() {
    ...
	ret = powerpc_vpadtl_get_buffer(vpaq);
	if (ret <= 0)
		return ret;

	boottb = (struct boottb_freq *)vpaq->buffer->data;
	if (boottb->timebase == 0) {
		vpaq->boot_tb = boottb->boot_tb;
    ...
}

[Severity: High]
This is a pre-existing issue, but is there a missing minimum size check here?

The auxtrace buffer payload is accessed as a struct boottb_freq and
boottb->timebase is checked. If the auxtrace buffer provides fewer bytes than
the size of the structure, could this read past the end of the provided payload
buffer?


tools/perf/util/powerpc-vpadtl.c:powerpc_vpadtl_sample() {
    ...
static int powerpc_vpadtl_sample(struct powerpc_vpadtl_entry *record,
		struct powerpc_vpadtl *vpa, u64 save, int cpu)
{
    ...
	sample.time = save;
	sample.raw_data = record;
	sample.raw_size = sizeof(record);
	event.sample.header.type = PERF_RECORD_SAMPLE;
    ...
}

[Severity: High]
This isn't a bug introduced by this patch, but does this sizeof() truncate the
sample raw size?

Because record is a pointer to struct powerpc_vpadtl_entry, sizeof(record)
evaluates to the size of a pointer (8 bytes) rather than the full struct size
(48 bytes). Could this cause downstream consumers to read out-of-bounds memory
when casting the raw data back to the structure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824025553.363863-1-wangyan01@kylinos.cn?part=1

Re: [PATCH] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check

[Adrian Hunter]

On 24/08/2026 05:55, Wang Yan wrote:
> min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
> auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
> POWERPC_VPADTL_TYPE + 1 elements.  POWERPC_VPADTL_TYPE is the first
> enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
> check validates only the perf_record_auxtrace_info header itself.  A
> PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
> passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
> read runs one u64 past the validated region.
> 
> This is the same off-by-one fixed for Intel PT by commit c4362d5e1a5e
> ("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
> and for Intel BTS by commit b9fb8225951c ("perf intel-bts: Fix off-by-one
> in auxtrace_info minimum size check").
> 
> Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
> priv index is covered by the minimum-size validation.
> 
> Fixes: c4bbd4ec2e50 ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wang Yan <wangyan01@kylinos.cn>

Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>

> ---
>  tools/perf/util/powerpc-vpadtl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
> index 710f3093f3f9..c15636eef34b 100644
> --- a/tools/perf/util/powerpc-vpadtl.c
> +++ b/tools/perf/util/powerpc-vpadtl.c
> @@ -683,7 +683,7 @@ int powerpc_vpadtl_process_auxtrace_info(union perf_event *event,
>  				  struct perf_session *session)
>  {
>  	struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
> -	size_t min_sz = sizeof(u64) * POWERPC_VPADTL_TYPE;
> +	size_t min_sz = sizeof(u64) * (POWERPC_VPADTL_TYPE + 1);
>  	struct powerpc_vpadtl *vpa;
>  	int err;
>