From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: sashiko-reviews@lists.linux.dev
Cc: linux-perf-users@vger.kernel.org
Subject: Re: [PATCH 01/27] perf session: Add minimum event size and alignment validation
Date: Thu, 21 May 2026 10:01:42 -0300 [thread overview]
Message-ID: <ag8CNsomAdrEF02X@x1> (raw)
In-Reply-To: <20260521015919.702051F000E9@smtp.kernel.org>
On Thu, May 21, 2026 at 01:59:19AM +0000, sashiko-bot@kernel.org wrote:
> Pre-existing issues:
> - [High] `perf_session__process_event` returns `event->header.size` for unknown event types, causing the stream reader to skip double the event size.
> >
> > if (event->header.type >= PERF_RECORD_HEADER_MAX) {
> > /* This perf is outdated and does not support the latest event type. */
> > ui__warning("Unsupported header type %u, please consider updating perf.\n",
> > event->header.type);
> > - return -EINVAL;
> > -
> > + /* Skip unsupported event by returning its size. */
> > + return event->header.size;
> > }
> [Severity: High]
> This is a pre-existing issue, but does returning event->header.size for
> unknown event types cause the stream reader to skip too far?
> When the caller reader__read_event() initializes size = event->header.size
> and adds the positive return value (skip), it causes the reader to advance
> by 2 * event->header.size.
> Could this misalign the stream and break parsing for the rest of the file?
Will be addressed in v2.
- Arnaldo
next prev parent reply other threads:[~2026-05-21 13:01 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-21 1:09 [PATCHES 00/27] perf.data validation and hardening Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 01/27] perf session: Add minimum event size and alignment validation Arnaldo Carvalho de Melo
2026-05-21 1:59 ` sashiko-bot
2026-05-21 13:01 ` Arnaldo Carvalho de Melo [this message]
2026-05-21 1:09 ` [PATCH 02/27] perf tools: Fix event_contains() macro to verify full field extent Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 03/27] perf zstd: Fix compression error path in zstd_compress_stream_to_records() Arnaldo Carvalho de Melo
2026-05-21 1:49 ` sashiko-bot
2026-05-21 1:09 ` [PATCH 04/27] perf zstd: Fix multi-iteration decompression and error handling Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 05/27] perf session: Fix PERF_RECORD_READ swap and dump for variable-length events Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 06/27] perf session: Fix swap_sample_id_all() crash on crafted events Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 07/27] perf session: Add validated swap infrastructure with null-termination checks Arnaldo Carvalho de Melo
2026-05-21 1:52 ` sashiko-bot
2026-05-21 1:09 ` [PATCH 08/27] perf session: Use bounded copy for PERF_RECORD_TIME_CONV Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 09/27] perf session: Validate HEADER_ATTR attr.size before swapping Arnaldo Carvalho de Melo
2026-05-21 2:04 ` sashiko-bot
2026-05-21 1:09 ` [PATCH 10/27] perf session: Validate nr fields against event size on both swap and common paths Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 11/27] perf header: Byte-swap build ID event pid and bounds check section entries Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 12/27] perf cpumap: Reject RANGE_CPUS with start_cpu > end_cpu Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 13/27] perf auxtrace: Harden auxtrace_error event handling Arnaldo Carvalho de Melo
2026-05-21 1:09 ` [PATCH 14/27] perf session: Add byte-swap and bounds check for PERF_RECORD_BPF_METADATA events Arnaldo Carvalho de Melo
2026-05-21 2:23 ` sashiko-bot
2026-05-21 1:10 ` [PATCH 15/27] perf header: Validate null-termination in PERF_RECORD_EVENT_UPDATE string fields Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 16/27] perf tools: Bounds check perf_event_attr fields against attr.size before printing Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 17/27] perf header: Propagate feature section processing errors Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 18/27] perf header: Validate f_attr.ids section before use in perf_session__read_header() Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 19/27] perf header: Validate feature section size and add read path bounds checking Arnaldo Carvalho de Melo
2026-05-21 2:34 ` sashiko-bot
2026-05-21 1:10 ` [PATCH 20/27] perf header: Sanity check HEADER_EVENT_DESC attr.size before swap Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 21/27] perf header: Validate bitmap size before allocating in do_read_bitmap() Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 22/27] perf session: Add byte-swap for PERF_RECORD_COMPRESSED2 events Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 23/27] perf tools: Harden compressed event processing Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 24/27] perf session: Check for decompression buffer size overflow Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 25/27] perf session: Bound nr_cpus_avail and validate sample CPU Arnaldo Carvalho de Melo
2026-05-21 2:43 ` sashiko-bot
2026-05-21 1:10 ` [PATCH 26/27] perf kwork: Bounds check work->cpu before indexing cpus_runtime[] Arnaldo Carvalho de Melo
2026-05-21 1:10 ` [PATCH 27/27] perf test: Add truncated perf.data robustness test Arnaldo Carvalho de Melo
2026-05-21 2:07 ` sashiko-bot
2026-05-21 12:57 ` Arnaldo Carvalho de Melo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ag8CNsomAdrEF02X@x1 \
--to=acme@kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox