* [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len
@ 2026-09-10 17:37 Ian Rogers
2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
` (2 more replies)
0 siblings, 3 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 17:37 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
This commit updates process_compressed() to ignore comp_mmap_len == 0
when validating the compressed header. A zero size is valid and may
occur during testing.
Sashiko review flagged string.h was missing (preexisting problem) and
so I opportunistically fixed this and sorted the header files.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
---
| 78 +++++++++++++++++++++-------------------
1 file changed, 41 insertions(+), 37 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 7db7da090a1e..bdd79d7542ef 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1,65 +1,68 @@
// SPDX-License-Identifier: GPL-2.0
+#include "header.h"
+
#include <errno.h>
#include <inttypes.h>
#include <limits.h>
-#include "string2.h"
-#include <sys/param.h>
-#include <sys/types.h>
-#include <byteswap.h>
-#include <unistd.h>
-#include <regex.h>
#include <stdio.h>
#include <stdlib.h>
+#include <string.h>
+
+#include <asm/bug.h>
+#include <byteswap.h>
+#include <dirent.h>
+#include <linux/bitops.h>
#include <linux/compiler.h>
-#include <linux/list.h>
+#include <linux/ctype.h>
#include <linux/kernel.h>
-#include <linux/bitops.h>
+#include <linux/list.h>
#include <linux/string.h>
#include <linux/stringify.h>
+#include <linux/time64.h>
#include <linux/zalloc.h>
+#include <regex.h>
+#include <sys/param.h>
#include <sys/stat.h>
+#include <sys/types.h>
#include <sys/utsname.h>
-#include <linux/time64.h>
-#include <dirent.h>
-#ifdef HAVE_LIBBPF_SUPPORT
-#include <bpf/libbpf.h>
-#endif
+#include <unistd.h>
+
+#include <api/fs/fs.h>
+#include <api/io_dir.h>
+#include <internal/lib.h>
#include <perf/cpumap.h>
#include <tools/libc_compat.h> // reallocarray
+#include "bpf-event.h"
+#include "bpf-utils.h"
+#include "build-id.h"
+#include "cacheline.h"
+#include "clockid.h"
+#include "cpumap.h"
+#include "cputopo.h"
+#include "data.h"
+#include "debug.h"
#include "dso.h"
#include "evlist.h"
#include "evsel.h"
-#include "util/evsel_fprintf.h"
-#include "header.h"
+#include "evsel_fprintf.h"
#include "memswap.h"
-#include "trace-event.h"
-#include "session.h"
-#include "symbol.h"
-#include "debug.h"
-#include "cpumap.h"
#include "pmu.h"
#include "pmus.h"
-#include "vdso.h"
+#include "session.h"
#include "strbuf.h"
-#include "build-id.h"
-#include "data.h"
-#include <api/fs/fs.h>
-#include <api/io_dir.h>
-#include "asm/bug.h"
-#include "tool.h"
-#include "../perf.h"
+#include "string2.h"
+#include "symbol.h"
#include "time-utils.h"
+#include "tool.h"
+#include "trace-event.h"
#include "units.h"
-#include "util/util.h" // perf_exe()
-#include "cputopo.h"
-#include "bpf-event.h"
-#include "bpf-utils.h"
-#include "clockid.h"
-#include "cacheline.h"
+#include "util.h" // perf_exe()
+#include "vdso.h"
-#include <linux/ctype.h>
-#include <internal/lib.h>
+#ifdef HAVE_LIBBPF_SUPPORT
+#include <bpf/libbpf.h>
+#endif
#ifdef HAVE_LIBTRACEEVENT
#include <event-parse.h>
@@ -3903,7 +3906,8 @@ static int process_compressed(struct feat_fd *ff,
* checks decomp_len + sizeof(struct decomp) against SIZE_MAX
* before allocating, which handles 32-bit safety.
*/
- if (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096) {
+ if (env->comp_mmap_len &&
+ (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096)) {
pr_err("Invalid HEADER_COMPRESSED: comp_mmap_len (%u) must be a 4K-aligned value >= 4096\n",
env->comp_mmap_len);
return -1;
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read
2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
@ 2026-09-10 17:37 ` Ian Rogers
2026-09-10 17:37 ` [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers
2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers
2 siblings, 0 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 17:37 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
strim may advance the pointer assigned to cache->size which causes
later frees to crash. Fix by performing the strim and then memmove-ing
the potentially shifted string back over the original string. The bug
was introduced by the transition from rtrim to strim, as rtrim
wouldn't move on the left.
Fixes: 13c230ab6e56 ("perf tools: Ditch rtrim(), use strim() from tools/lib")
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
---
| 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index bdd79d7542ef..78b16a098148 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1267,7 +1267,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
return -1;
cache->type[len] = 0;
- cache->type = strim(cache->type);
+ {
+ char *trimmed = strim(cache->type);
+
+ memmove(cache->type, trimmed, strlen(trimmed) + 1);
+ }
scnprintf(file, PATH_MAX, "%s/size", path);
if (sysfs__read_str(file, &cache->size, &len)) {
@@ -1276,7 +1280,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
}
cache->size[len] = 0;
- cache->size = strim(cache->size);
+ {
+ char *trimmed = strim(cache->size);
+
+ memmove(cache->size, trimmed, strlen(trimmed) + 1);
+ }
scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
if (sysfs__read_str(file, &cache->map, &len)) {
@@ -1286,7 +1294,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
}
cache->map[len] = 0;
- cache->map = strim(cache->map);
+ {
+ char *trimmed = strim(cache->map);
+
+ memmove(cache->map, trimmed, strlen(trimmed) + 1);
+ }
return 0;
}
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents
2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
@ 2026-09-10 17:37 ` Ian Rogers
2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers
2 siblings, 0 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 17:37 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
Avoid a checkpatch.pl warning on the use of asm/bug.h by switching the
use of WARN macros to explicit tests and then using pr_warning from
debug.h.
Signed-off-by: Ian Rogers <irogers@google.com>
---
| 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 78b16a098148..a3e6c334a289 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -8,7 +8,6 @@
#include <stdlib.h>
#include <string.h>
-#include <asm/bug.h>
#include <byteswap.h>
#include <dirent.h>
#include <linux/bitops.h>
@@ -384,8 +383,10 @@ static int do_read_bitmap(struct feat_fd *ff, unsigned long **pset, u64 *psize)
static int write_tracing_data(struct feat_fd *ff,
struct evlist *evlist __maybe_unused)
{
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
#ifdef HAVE_LIBTRACEEVENT
return read_tracing_data(ff->fd, &evlist__core(evlist)->entries);
@@ -406,8 +407,10 @@ static int write_build_id(struct feat_fd *ff,
if (!perf_session__read_build_ids(session, true))
return -1;
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
err = perf_session__write_buildid_table(session, ff);
if (err < 0) {
@@ -1013,8 +1016,10 @@ static int write_auxtrace(struct feat_fd *ff,
struct perf_session *session;
int err;
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
session = container_of(ff->ph, struct perf_session, header);
@@ -1108,9 +1113,10 @@ static int write_dir_format(struct feat_fd *ff,
session = container_of(ff->ph, struct perf_session, header);
data = session->data;
- if (WARN_ON(!perf_data__is_dir(data)))
+ if (!perf_data__is_dir(data)) {
+ pr_warning("Expected data to be a directory");
return -1;
-
+ }
return do_write(ff, &data->dir.version, sizeof(data->dir.version));
}
@@ -3714,9 +3720,10 @@ static int process_dir_format(struct feat_fd *ff,
session = container_of(ff->ph, struct perf_session, header);
data = session->data;
- if (WARN_ON(!perf_data__is_dir(data)))
+ if (!perf_data__is_dir(data)) {
+ pr_warning("Expected data to be a directory");
return -1;
-
+ }
return do_read_u64(ff, &data->dir.version);
}
@@ -4394,8 +4401,10 @@ static int do_write_feat(struct feat_fd *ff, int type,
if (!feat_ops[type].write)
return -1;
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
(*p)->offset = lseek(ff->fd, 0, SEEK_CUR);
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison
2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
2026-09-10 17:37 ` [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers
@ 2026-09-10 17:56 ` Ian Rogers
2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
` (2 more replies)
2 siblings, 3 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 17:56 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
__msan_unpoison may need the sanitizer header including for its
definition.
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/arch/x86/tests/dwarf-unwind.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/perf/arch/x86/tests/dwarf-unwind.c b/tools/perf/arch/x86/tests/dwarf-unwind.c
index 99d2b7ed016f..3c66dadcab75 100644
--- a/tools/perf/arch/x86/tests/dwarf-unwind.c
+++ b/tools/perf/arch/x86/tests/dwarf-unwind.c
@@ -8,6 +8,10 @@
#include "debug.h"
#include "tests/tests.h"
+#if defined(MEMORY_SANITIZER) && !defined(__msan_unpoison)
+# include <sanitizer/msan_interface.h>
+#endif
+
#define STACK_SIZE 8192
static int sample_ustack(struct perf_sample *sample,
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len
2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers
@ 2026-09-10 17:56 ` Ian Rogers
2026-09-10 17:56 ` [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers
2 siblings, 0 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 17:56 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
This commit updates process_compressed() to ignore comp_mmap_len == 0
when validating the compressed header. A zero size is valid and may
occur during testing.
Sashiko review flagged string.h was missing (preexisting problem) and
so I opportunistically fixed this and sorted the header files.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
---
| 78 +++++++++++++++++++++-------------------
1 file changed, 41 insertions(+), 37 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 7db7da090a1e..bdd79d7542ef 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1,65 +1,68 @@
// SPDX-License-Identifier: GPL-2.0
+#include "header.h"
+
#include <errno.h>
#include <inttypes.h>
#include <limits.h>
-#include "string2.h"
-#include <sys/param.h>
-#include <sys/types.h>
-#include <byteswap.h>
-#include <unistd.h>
-#include <regex.h>
#include <stdio.h>
#include <stdlib.h>
+#include <string.h>
+
+#include <asm/bug.h>
+#include <byteswap.h>
+#include <dirent.h>
+#include <linux/bitops.h>
#include <linux/compiler.h>
-#include <linux/list.h>
+#include <linux/ctype.h>
#include <linux/kernel.h>
-#include <linux/bitops.h>
+#include <linux/list.h>
#include <linux/string.h>
#include <linux/stringify.h>
+#include <linux/time64.h>
#include <linux/zalloc.h>
+#include <regex.h>
+#include <sys/param.h>
#include <sys/stat.h>
+#include <sys/types.h>
#include <sys/utsname.h>
-#include <linux/time64.h>
-#include <dirent.h>
-#ifdef HAVE_LIBBPF_SUPPORT
-#include <bpf/libbpf.h>
-#endif
+#include <unistd.h>
+
+#include <api/fs/fs.h>
+#include <api/io_dir.h>
+#include <internal/lib.h>
#include <perf/cpumap.h>
#include <tools/libc_compat.h> // reallocarray
+#include "bpf-event.h"
+#include "bpf-utils.h"
+#include "build-id.h"
+#include "cacheline.h"
+#include "clockid.h"
+#include "cpumap.h"
+#include "cputopo.h"
+#include "data.h"
+#include "debug.h"
#include "dso.h"
#include "evlist.h"
#include "evsel.h"
-#include "util/evsel_fprintf.h"
-#include "header.h"
+#include "evsel_fprintf.h"
#include "memswap.h"
-#include "trace-event.h"
-#include "session.h"
-#include "symbol.h"
-#include "debug.h"
-#include "cpumap.h"
#include "pmu.h"
#include "pmus.h"
-#include "vdso.h"
+#include "session.h"
#include "strbuf.h"
-#include "build-id.h"
-#include "data.h"
-#include <api/fs/fs.h>
-#include <api/io_dir.h>
-#include "asm/bug.h"
-#include "tool.h"
-#include "../perf.h"
+#include "string2.h"
+#include "symbol.h"
#include "time-utils.h"
+#include "tool.h"
+#include "trace-event.h"
#include "units.h"
-#include "util/util.h" // perf_exe()
-#include "cputopo.h"
-#include "bpf-event.h"
-#include "bpf-utils.h"
-#include "clockid.h"
-#include "cacheline.h"
+#include "util.h" // perf_exe()
+#include "vdso.h"
-#include <linux/ctype.h>
-#include <internal/lib.h>
+#ifdef HAVE_LIBBPF_SUPPORT
+#include <bpf/libbpf.h>
+#endif
#ifdef HAVE_LIBTRACEEVENT
#include <event-parse.h>
@@ -3903,7 +3906,8 @@ static int process_compressed(struct feat_fd *ff,
* checks decomp_len + sizeof(struct decomp) against SIZE_MAX
* before allocating, which handles 32-bit safety.
*/
- if (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096) {
+ if (env->comp_mmap_len &&
+ (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096)) {
pr_err("Invalid HEADER_COMPRESSED: comp_mmap_len (%u) must be a 4K-aligned value >= 4096\n",
env->comp_mmap_len);
return -1;
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read
2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers
2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
@ 2026-09-10 17:56 ` Ian Rogers
2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers
2 siblings, 0 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 17:56 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
strim may advance the pointer assigned to cache->size which causes
later frees to crash. Fix by performing the strim and then memmove-ing
the potentially shifted string back over the original string. The bug
was introduced by the transition from rtrim to strim, as rtrim
wouldn't move on the left.
Fixes: 13c230ab6e56 ("perf tools: Ditch rtrim(), use strim() from tools/lib")
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
---
| 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index bdd79d7542ef..78b16a098148 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1267,7 +1267,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
return -1;
cache->type[len] = 0;
- cache->type = strim(cache->type);
+ {
+ char *trimmed = strim(cache->type);
+
+ memmove(cache->type, trimmed, strlen(trimmed) + 1);
+ }
scnprintf(file, PATH_MAX, "%s/size", path);
if (sysfs__read_str(file, &cache->size, &len)) {
@@ -1276,7 +1280,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
}
cache->size[len] = 0;
- cache->size = strim(cache->size);
+ {
+ char *trimmed = strim(cache->size);
+
+ memmove(cache->size, trimmed, strlen(trimmed) + 1);
+ }
scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
if (sysfs__read_str(file, &cache->map, &len)) {
@@ -1286,7 +1294,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
}
cache->map[len] = 0;
- cache->map = strim(cache->map);
+ {
+ char *trimmed = strim(cache->map);
+
+ memmove(cache->map, trimmed, strlen(trimmed) + 1);
+ }
return 0;
}
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning
2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers
2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
2026-09-10 17:56 ` [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
@ 2026-09-10 21:12 ` Ian Rogers
2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
` (2 more replies)
2 siblings, 3 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
Some minor fixes that have shown up during testing.
v3: Fix Sashiko include nit. Accidentally posted wrong 1st patch in v2 (sorry :-( )
v2: Fix missing newling for pr_warning:
https://lore.kernel.org/linux-perf-users/20260910175634.3014018-1-irogers@google.com/
v1:
https://lore.kernel.org/linux-perf-users/20260910173715.2996571-1-irogers@google.com/
Ian Rogers (3):
perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len
perf header: Fix potential memory corruption in cpu_cache_level__read
perf header: Transition WARN macros to debug.h equivalents
tools/perf/util/header.c | 122 ++++++++++++++++++++++++---------------
1 file changed, 74 insertions(+), 48 deletions(-)
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len
2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers
@ 2026-09-10 21:12 ` Ian Rogers
2026-09-10 21:12 ` [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
2026-09-10 21:12 ` [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers
2 siblings, 0 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
This commit updates process_compressed() to ignore comp_mmap_len == 0
when validating the compressed header. A zero size is valid and may
occur during testing.
Sashiko review flagged string.h was missing (preexisting problem) and
so I opportunistically fixed this and sorted the header files.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
---
| 79 +++++++++++++++++++++-------------------
1 file changed, 42 insertions(+), 37 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 7db7da090a1e..974ce1c926cd 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1,65 +1,69 @@
// SPDX-License-Identifier: GPL-2.0
+#include "header.h"
+
#include <errno.h>
#include <inttypes.h>
#include <limits.h>
-#include "string2.h"
-#include <sys/param.h>
-#include <sys/types.h>
-#include <byteswap.h>
-#include <unistd.h>
-#include <regex.h>
#include <stdio.h>
#include <stdlib.h>
+#include <string.h>
+
+#include <asm/bug.h>
+#include <byteswap.h>
+#include <dirent.h>
+#include <linux/bitops.h>
#include <linux/compiler.h>
-#include <linux/list.h>
+#include <linux/ctype.h>
#include <linux/kernel.h>
-#include <linux/bitops.h>
+#include <linux/list.h>
#include <linux/string.h>
#include <linux/stringify.h>
+#include <linux/time64.h>
#include <linux/zalloc.h>
+#include <regex.h>
+#include <sys/param.h>
#include <sys/stat.h>
+#include <sys/types.h>
#include <sys/utsname.h>
-#include <linux/time64.h>
-#include <dirent.h>
-#ifdef HAVE_LIBBPF_SUPPORT
-#include <bpf/libbpf.h>
-#endif
+#include <unistd.h>
+
+#include <api/fs/fs.h>
+#include <api/io_dir.h>
+#include <internal/lib.h>
#include <perf/cpumap.h>
#include <tools/libc_compat.h> // reallocarray
+#include "../perf.h"
+#include "bpf-event.h"
+#include "bpf-utils.h"
+#include "build-id.h"
+#include "cacheline.h"
+#include "clockid.h"
+#include "cpumap.h"
+#include "cputopo.h"
+#include "data.h"
+#include "debug.h"
#include "dso.h"
#include "evlist.h"
#include "evsel.h"
-#include "util/evsel_fprintf.h"
-#include "header.h"
+#include "evsel_fprintf.h"
#include "memswap.h"
-#include "trace-event.h"
-#include "session.h"
-#include "symbol.h"
-#include "debug.h"
-#include "cpumap.h"
#include "pmu.h"
#include "pmus.h"
-#include "vdso.h"
+#include "session.h"
#include "strbuf.h"
-#include "build-id.h"
-#include "data.h"
-#include <api/fs/fs.h>
-#include <api/io_dir.h>
-#include "asm/bug.h"
-#include "tool.h"
-#include "../perf.h"
+#include "string2.h"
+#include "symbol.h"
#include "time-utils.h"
+#include "tool.h"
+#include "trace-event.h"
#include "units.h"
-#include "util/util.h" // perf_exe()
-#include "cputopo.h"
-#include "bpf-event.h"
-#include "bpf-utils.h"
-#include "clockid.h"
-#include "cacheline.h"
+#include "util.h" // perf_exe()
+#include "vdso.h"
-#include <linux/ctype.h>
-#include <internal/lib.h>
+#ifdef HAVE_LIBBPF_SUPPORT
+#include <bpf/libbpf.h>
+#endif
#ifdef HAVE_LIBTRACEEVENT
#include <event-parse.h>
@@ -3903,7 +3907,8 @@ static int process_compressed(struct feat_fd *ff,
* checks decomp_len + sizeof(struct decomp) against SIZE_MAX
* before allocating, which handles 32-bit safety.
*/
- if (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096) {
+ if (env->comp_mmap_len &&
+ (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096)) {
pr_err("Invalid HEADER_COMPRESSED: comp_mmap_len (%u) must be a 4K-aligned value >= 4096\n",
env->comp_mmap_len);
return -1;
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read
2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers
2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
@ 2026-09-10 21:12 ` Ian Rogers
2026-09-10 21:12 ` [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers
2 siblings, 0 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
strim may advance the pointer assigned to cache->size which causes
later frees to crash. Fix by performing the strim and then memmove-ing
the potentially shifted string back over the original string. The bug
was introduced by the transition from rtrim to strim, as rtrim
wouldn't move on the left.
Fixes: 13c230ab6e56 ("perf tools: Ditch rtrim(), use strim() from tools/lib")
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
---
| 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 974ce1c926cd..0a4236fc0293 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1268,7 +1268,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
return -1;
cache->type[len] = 0;
- cache->type = strim(cache->type);
+ {
+ char *trimmed = strim(cache->type);
+
+ memmove(cache->type, trimmed, strlen(trimmed) + 1);
+ }
scnprintf(file, PATH_MAX, "%s/size", path);
if (sysfs__read_str(file, &cache->size, &len)) {
@@ -1277,7 +1281,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
}
cache->size[len] = 0;
- cache->size = strim(cache->size);
+ {
+ char *trimmed = strim(cache->size);
+
+ memmove(cache->size, trimmed, strlen(trimmed) + 1);
+ }
scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
if (sysfs__read_str(file, &cache->map, &len)) {
@@ -1287,7 +1295,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
}
cache->map[len] = 0;
- cache->map = strim(cache->map);
+ {
+ char *trimmed = strim(cache->map);
+
+ memmove(cache->map, trimmed, strlen(trimmed) + 1);
+ }
return 0;
}
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents
2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers
2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
2026-09-10 21:12 ` [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
@ 2026-09-10 21:12 ` Ian Rogers
2 siblings, 0 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
Avoid a checkpatch.pl warning on the use of asm/bug.h by switching the
use of WARN macros to explicit tests and then using pr_warning from
debug.h.
Signed-off-by: Ian Rogers <irogers@google.com>
---
| 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 0a4236fc0293..c7f2c29f02b0 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -8,7 +8,6 @@
#include <stdlib.h>
#include <string.h>
-#include <asm/bug.h>
#include <byteswap.h>
#include <dirent.h>
#include <linux/bitops.h>
@@ -385,8 +384,10 @@ static int do_read_bitmap(struct feat_fd *ff, unsigned long **pset, u64 *psize)
static int write_tracing_data(struct feat_fd *ff,
struct evlist *evlist __maybe_unused)
{
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
#ifdef HAVE_LIBTRACEEVENT
return read_tracing_data(ff->fd, &evlist__core(evlist)->entries);
@@ -407,8 +408,10 @@ static int write_build_id(struct feat_fd *ff,
if (!perf_session__read_build_ids(session, true))
return -1;
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
err = perf_session__write_buildid_table(session, ff);
if (err < 0) {
@@ -1014,8 +1017,10 @@ static int write_auxtrace(struct feat_fd *ff,
struct perf_session *session;
int err;
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
session = container_of(ff->ph, struct perf_session, header);
@@ -1109,9 +1114,10 @@ static int write_dir_format(struct feat_fd *ff,
session = container_of(ff->ph, struct perf_session, header);
data = session->data;
- if (WARN_ON(!perf_data__is_dir(data)))
+ if (!perf_data__is_dir(data)) {
+ pr_warning("Expected data to be a directory\n");
return -1;
-
+ }
return do_write(ff, &data->dir.version, sizeof(data->dir.version));
}
@@ -3715,9 +3721,10 @@ static int process_dir_format(struct feat_fd *ff,
session = container_of(ff->ph, struct perf_session, header);
data = session->data;
- if (WARN_ON(!perf_data__is_dir(data)))
+ if (!perf_data__is_dir(data)) {
+ pr_warning("Expected data to be a directory\n");
return -1;
-
+ }
return do_read_u64(ff, &data->dir.version);
}
@@ -4395,8 +4402,10 @@ static int do_write_feat(struct feat_fd *ff, int type,
if (!feat_ops[type].write)
return -1;
- if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__))
+ if (ff->buf) {
+ pr_warning("Error: calling %s in pipe-mode.\n", __func__);
return -1;
+ }
(*p)->offset = lseek(ff->fd, 0, SEEK_CUR);
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-09-10 21:12 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
2026-09-10 17:37 ` [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers
2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers
2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
2026-09-10 17:56 ` [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers
2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers
2026-09-10 21:12 ` [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
2026-09-10 21:12 ` [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®