* [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len
@ 2026-09-10 17:37 Ian Rogers
2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers
` (2 more replies)
0 siblings, 3 replies; 10+ messages in thread
From: Ian Rogers @ 2026-09-10 17:37 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark,
Swapnil Sapkal, linux-perf-users, linux-kernel
This commit updates process_compressed() to ignore comp_mmap_len == 0
when validating the compressed header. A zero size is valid and may
occur during testing.
Sashiko review flagged string.h was missing (preexisting problem) and
so I opportunistically fixed this and sorted the header files.
Signed-off-by: Ian Rogers <irogers@google.com>
Assisted-by: Antigravity:gemini-3.1-pro
---
tools/perf/util/header.c | 78 +++++++++++++++++++++-------------------
1 file changed, 41 insertions(+), 37 deletions(-)
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 7db7da090a1e..bdd79d7542ef 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1,65 +1,68 @@
// SPDX-License-Identifier: GPL-2.0
+#include "header.h"
+
#include <errno.h>
#include <inttypes.h>
#include <limits.h>
-#include "string2.h"
-#include <sys/param.h>
-#include <sys/types.h>
-#include <byteswap.h>
-#include <unistd.h>
-#include <regex.h>
#include <stdio.h>
#include <stdlib.h>
+#include <string.h>
+
+#include <asm/bug.h>
+#include <byteswap.h>
+#include <dirent.h>
+#include <linux/bitops.h>
#include <linux/compiler.h>
-#include <linux/list.h>
+#include <linux/ctype.h>
#include <linux/kernel.h>
-#include <linux/bitops.h>
+#include <linux/list.h>
#include <linux/string.h>
#include <linux/stringify.h>
+#include <linux/time64.h>
#include <linux/zalloc.h>
+#include <regex.h>
+#include <sys/param.h>
#include <sys/stat.h>
+#include <sys/types.h>
#include <sys/utsname.h>
-#include <linux/time64.h>
-#include <dirent.h>
-#ifdef HAVE_LIBBPF_SUPPORT
-#include <bpf/libbpf.h>
-#endif
+#include <unistd.h>
+
+#include <api/fs/fs.h>
+#include <api/io_dir.h>
+#include <internal/lib.h>
#include <perf/cpumap.h>
#include <tools/libc_compat.h> // reallocarray
+#include "bpf-event.h"
+#include "bpf-utils.h"
+#include "build-id.h"
+#include "cacheline.h"
+#include "clockid.h"
+#include "cpumap.h"
+#include "cputopo.h"
+#include "data.h"
+#include "debug.h"
#include "dso.h"
#include "evlist.h"
#include "evsel.h"
-#include "util/evsel_fprintf.h"
-#include "header.h"
+#include "evsel_fprintf.h"
#include "memswap.h"
-#include "trace-event.h"
-#include "session.h"
-#include "symbol.h"
-#include "debug.h"
-#include "cpumap.h"
#include "pmu.h"
#include "pmus.h"
-#include "vdso.h"
+#include "session.h"
#include "strbuf.h"
-#include "build-id.h"
-#include "data.h"
-#include <api/fs/fs.h>
-#include <api/io_dir.h>
-#include "asm/bug.h"
-#include "tool.h"
-#include "../perf.h"
+#include "string2.h"
+#include "symbol.h"
#include "time-utils.h"
+#include "tool.h"
+#include "trace-event.h"
#include "units.h"
-#include "util/util.h" // perf_exe()
-#include "cputopo.h"
-#include "bpf-event.h"
-#include "bpf-utils.h"
-#include "clockid.h"
-#include "cacheline.h"
+#include "util.h" // perf_exe()
+#include "vdso.h"
-#include <linux/ctype.h>
-#include <internal/lib.h>
+#ifdef HAVE_LIBBPF_SUPPORT
+#include <bpf/libbpf.h>
+#endif
#ifdef HAVE_LIBTRACEEVENT
#include <event-parse.h>
@@ -3903,7 +3906,8 @@ static int process_compressed(struct feat_fd *ff,
* checks decomp_len + sizeof(struct decomp) against SIZE_MAX
* before allocating, which handles 32-bit safety.
*/
- if (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096) {
+ if (env->comp_mmap_len &&
+ (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096)) {
pr_err("Invalid HEADER_COMPRESSED: comp_mmap_len (%u) must be a 4K-aligned value >= 4096\n",
env->comp_mmap_len);
return -1;
--
2.55.0.1007.g17ff1f9808-goog
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read 2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers @ 2026-09-10 17:37 ` Ian Rogers 2026-09-10 17:37 ` [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers 2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers 2 siblings, 0 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 17:37 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel strim may advance the pointer assigned to cache->size which causes later frees to crash. Fix by performing the strim and then memmove-ing the potentially shifted string back over the original string. The bug was introduced by the transition from rtrim to strim, as rtrim wouldn't move on the left. Fixes: 13c230ab6e56 ("perf tools: Ditch rtrim(), use strim() from tools/lib") Signed-off-by: Ian Rogers <irogers@google.com> Assisted-by: Antigravity:gemini-3.1-pro --- tools/perf/util/header.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index bdd79d7542ef..78b16a098148 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -1267,7 +1267,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev return -1; cache->type[len] = 0; - cache->type = strim(cache->type); + { + char *trimmed = strim(cache->type); + + memmove(cache->type, trimmed, strlen(trimmed) + 1); + } scnprintf(file, PATH_MAX, "%s/size", path); if (sysfs__read_str(file, &cache->size, &len)) { @@ -1276,7 +1280,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev } cache->size[len] = 0; - cache->size = strim(cache->size); + { + char *trimmed = strim(cache->size); + + memmove(cache->size, trimmed, strlen(trimmed) + 1); + } scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path); if (sysfs__read_str(file, &cache->map, &len)) { @@ -1286,7 +1294,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev } cache->map[len] = 0; - cache->map = strim(cache->map); + { + char *trimmed = strim(cache->map); + + memmove(cache->map, trimmed, strlen(trimmed) + 1); + } return 0; } -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents 2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers 2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers @ 2026-09-10 17:37 ` Ian Rogers 2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers 2 siblings, 0 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 17:37 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel Avoid a checkpatch.pl warning on the use of asm/bug.h by switching the use of WARN macros to explicit tests and then using pr_warning from debug.h. Signed-off-by: Ian Rogers <irogers@google.com> --- tools/perf/util/header.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 78b16a098148..a3e6c334a289 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -8,7 +8,6 @@ #include <stdlib.h> #include <string.h> -#include <asm/bug.h> #include <byteswap.h> #include <dirent.h> #include <linux/bitops.h> @@ -384,8 +383,10 @@ static int do_read_bitmap(struct feat_fd *ff, unsigned long **pset, u64 *psize) static int write_tracing_data(struct feat_fd *ff, struct evlist *evlist __maybe_unused) { - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } #ifdef HAVE_LIBTRACEEVENT return read_tracing_data(ff->fd, &evlist__core(evlist)->entries); @@ -406,8 +407,10 @@ static int write_build_id(struct feat_fd *ff, if (!perf_session__read_build_ids(session, true)) return -1; - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } err = perf_session__write_buildid_table(session, ff); if (err < 0) { @@ -1013,8 +1016,10 @@ static int write_auxtrace(struct feat_fd *ff, struct perf_session *session; int err; - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } session = container_of(ff->ph, struct perf_session, header); @@ -1108,9 +1113,10 @@ static int write_dir_format(struct feat_fd *ff, session = container_of(ff->ph, struct perf_session, header); data = session->data; - if (WARN_ON(!perf_data__is_dir(data))) + if (!perf_data__is_dir(data)) { + pr_warning("Expected data to be a directory"); return -1; - + } return do_write(ff, &data->dir.version, sizeof(data->dir.version)); } @@ -3714,9 +3720,10 @@ static int process_dir_format(struct feat_fd *ff, session = container_of(ff->ph, struct perf_session, header); data = session->data; - if (WARN_ON(!perf_data__is_dir(data))) + if (!perf_data__is_dir(data)) { + pr_warning("Expected data to be a directory"); return -1; - + } return do_read_u64(ff, &data->dir.version); } @@ -4394,8 +4401,10 @@ static int do_write_feat(struct feat_fd *ff, int type, if (!feat_ops[type].write) return -1; - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } (*p)->offset = lseek(ff->fd, 0, SEEK_CUR); -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison 2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers 2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers 2026-09-10 17:37 ` [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers @ 2026-09-10 17:56 ` Ian Rogers 2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers ` (2 more replies) 2 siblings, 3 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 17:56 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel __msan_unpoison may need the sanitizer header including for its definition. Signed-off-by: Ian Rogers <irogers@google.com> --- tools/perf/arch/x86/tests/dwarf-unwind.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/perf/arch/x86/tests/dwarf-unwind.c b/tools/perf/arch/x86/tests/dwarf-unwind.c index 99d2b7ed016f..3c66dadcab75 100644 --- a/tools/perf/arch/x86/tests/dwarf-unwind.c +++ b/tools/perf/arch/x86/tests/dwarf-unwind.c @@ -8,6 +8,10 @@ #include "debug.h" #include "tests/tests.h" +#if defined(MEMORY_SANITIZER) && !defined(__msan_unpoison) +# include <sanitizer/msan_interface.h> +#endif + #define STACK_SIZE 8192 static int sample_ustack(struct perf_sample *sample, -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len 2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers @ 2026-09-10 17:56 ` Ian Rogers 2026-09-10 17:56 ` [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers 2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers 2 siblings, 0 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 17:56 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel This commit updates process_compressed() to ignore comp_mmap_len == 0 when validating the compressed header. A zero size is valid and may occur during testing. Sashiko review flagged string.h was missing (preexisting problem) and so I opportunistically fixed this and sorted the header files. Signed-off-by: Ian Rogers <irogers@google.com> Assisted-by: Antigravity:gemini-3.1-pro --- tools/perf/util/header.c | 78 +++++++++++++++++++++------------------- 1 file changed, 41 insertions(+), 37 deletions(-) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 7db7da090a1e..bdd79d7542ef 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -1,65 +1,68 @@ // SPDX-License-Identifier: GPL-2.0 +#include "header.h" + #include <errno.h> #include <inttypes.h> #include <limits.h> -#include "string2.h" -#include <sys/param.h> -#include <sys/types.h> -#include <byteswap.h> -#include <unistd.h> -#include <regex.h> #include <stdio.h> #include <stdlib.h> +#include <string.h> + +#include <asm/bug.h> +#include <byteswap.h> +#include <dirent.h> +#include <linux/bitops.h> #include <linux/compiler.h> -#include <linux/list.h> +#include <linux/ctype.h> #include <linux/kernel.h> -#include <linux/bitops.h> +#include <linux/list.h> #include <linux/string.h> #include <linux/stringify.h> +#include <linux/time64.h> #include <linux/zalloc.h> +#include <regex.h> +#include <sys/param.h> #include <sys/stat.h> +#include <sys/types.h> #include <sys/utsname.h> -#include <linux/time64.h> -#include <dirent.h> -#ifdef HAVE_LIBBPF_SUPPORT -#include <bpf/libbpf.h> -#endif +#include <unistd.h> + +#include <api/fs/fs.h> +#include <api/io_dir.h> +#include <internal/lib.h> #include <perf/cpumap.h> #include <tools/libc_compat.h> // reallocarray +#include "bpf-event.h" +#include "bpf-utils.h" +#include "build-id.h" +#include "cacheline.h" +#include "clockid.h" +#include "cpumap.h" +#include "cputopo.h" +#include "data.h" +#include "debug.h" #include "dso.h" #include "evlist.h" #include "evsel.h" -#include "util/evsel_fprintf.h" -#include "header.h" +#include "evsel_fprintf.h" #include "memswap.h" -#include "trace-event.h" -#include "session.h" -#include "symbol.h" -#include "debug.h" -#include "cpumap.h" #include "pmu.h" #include "pmus.h" -#include "vdso.h" +#include "session.h" #include "strbuf.h" -#include "build-id.h" -#include "data.h" -#include <api/fs/fs.h> -#include <api/io_dir.h> -#include "asm/bug.h" -#include "tool.h" -#include "../perf.h" +#include "string2.h" +#include "symbol.h" #include "time-utils.h" +#include "tool.h" +#include "trace-event.h" #include "units.h" -#include "util/util.h" // perf_exe() -#include "cputopo.h" -#include "bpf-event.h" -#include "bpf-utils.h" -#include "clockid.h" -#include "cacheline.h" +#include "util.h" // perf_exe() +#include "vdso.h" -#include <linux/ctype.h> -#include <internal/lib.h> +#ifdef HAVE_LIBBPF_SUPPORT +#include <bpf/libbpf.h> +#endif #ifdef HAVE_LIBTRACEEVENT #include <event-parse.h> @@ -3903,7 +3906,8 @@ static int process_compressed(struct feat_fd *ff, * checks decomp_len + sizeof(struct decomp) against SIZE_MAX * before allocating, which handles 32-bit safety. */ - if (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096) { + if (env->comp_mmap_len && + (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096)) { pr_err("Invalid HEADER_COMPRESSED: comp_mmap_len (%u) must be a 4K-aligned value >= 4096\n", env->comp_mmap_len); return -1; -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read 2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers 2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers @ 2026-09-10 17:56 ` Ian Rogers 2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers 2 siblings, 0 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 17:56 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel strim may advance the pointer assigned to cache->size which causes later frees to crash. Fix by performing the strim and then memmove-ing the potentially shifted string back over the original string. The bug was introduced by the transition from rtrim to strim, as rtrim wouldn't move on the left. Fixes: 13c230ab6e56 ("perf tools: Ditch rtrim(), use strim() from tools/lib") Signed-off-by: Ian Rogers <irogers@google.com> Assisted-by: Antigravity:gemini-3.1-pro --- tools/perf/util/header.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index bdd79d7542ef..78b16a098148 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -1267,7 +1267,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev return -1; cache->type[len] = 0; - cache->type = strim(cache->type); + { + char *trimmed = strim(cache->type); + + memmove(cache->type, trimmed, strlen(trimmed) + 1); + } scnprintf(file, PATH_MAX, "%s/size", path); if (sysfs__read_str(file, &cache->size, &len)) { @@ -1276,7 +1280,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev } cache->size[len] = 0; - cache->size = strim(cache->size); + { + char *trimmed = strim(cache->size); + + memmove(cache->size, trimmed, strlen(trimmed) + 1); + } scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path); if (sysfs__read_str(file, &cache->map, &len)) { @@ -1286,7 +1294,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev } cache->map[len] = 0; - cache->map = strim(cache->map); + { + char *trimmed = strim(cache->map); + + memmove(cache->map, trimmed, strlen(trimmed) + 1); + } return 0; } -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning 2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers 2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers 2026-09-10 17:56 ` [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers @ 2026-09-10 21:12 ` Ian Rogers 2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers ` (2 more replies) 2 siblings, 3 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel Some minor fixes that have shown up during testing. v3: Fix Sashiko include nit. Accidentally posted wrong 1st patch in v2 (sorry :-( ) v2: Fix missing newling for pr_warning: https://lore.kernel.org/linux-perf-users/20260910175634.3014018-1-irogers@google.com/ v1: https://lore.kernel.org/linux-perf-users/20260910173715.2996571-1-irogers@google.com/ Ian Rogers (3): perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len perf header: Fix potential memory corruption in cpu_cache_level__read perf header: Transition WARN macros to debug.h equivalents tools/perf/util/header.c | 122 ++++++++++++++++++++++++--------------- 1 file changed, 74 insertions(+), 48 deletions(-) -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len 2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers @ 2026-09-10 21:12 ` Ian Rogers 2026-09-10 21:12 ` [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers 2026-09-10 21:12 ` [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers 2 siblings, 0 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel This commit updates process_compressed() to ignore comp_mmap_len == 0 when validating the compressed header. A zero size is valid and may occur during testing. Sashiko review flagged string.h was missing (preexisting problem) and so I opportunistically fixed this and sorted the header files. Signed-off-by: Ian Rogers <irogers@google.com> Assisted-by: Antigravity:gemini-3.1-pro --- tools/perf/util/header.c | 79 +++++++++++++++++++++------------------- 1 file changed, 42 insertions(+), 37 deletions(-) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 7db7da090a1e..974ce1c926cd 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -1,65 +1,69 @@ // SPDX-License-Identifier: GPL-2.0 +#include "header.h" + #include <errno.h> #include <inttypes.h> #include <limits.h> -#include "string2.h" -#include <sys/param.h> -#include <sys/types.h> -#include <byteswap.h> -#include <unistd.h> -#include <regex.h> #include <stdio.h> #include <stdlib.h> +#include <string.h> + +#include <asm/bug.h> +#include <byteswap.h> +#include <dirent.h> +#include <linux/bitops.h> #include <linux/compiler.h> -#include <linux/list.h> +#include <linux/ctype.h> #include <linux/kernel.h> -#include <linux/bitops.h> +#include <linux/list.h> #include <linux/string.h> #include <linux/stringify.h> +#include <linux/time64.h> #include <linux/zalloc.h> +#include <regex.h> +#include <sys/param.h> #include <sys/stat.h> +#include <sys/types.h> #include <sys/utsname.h> -#include <linux/time64.h> -#include <dirent.h> -#ifdef HAVE_LIBBPF_SUPPORT -#include <bpf/libbpf.h> -#endif +#include <unistd.h> + +#include <api/fs/fs.h> +#include <api/io_dir.h> +#include <internal/lib.h> #include <perf/cpumap.h> #include <tools/libc_compat.h> // reallocarray +#include "../perf.h" +#include "bpf-event.h" +#include "bpf-utils.h" +#include "build-id.h" +#include "cacheline.h" +#include "clockid.h" +#include "cpumap.h" +#include "cputopo.h" +#include "data.h" +#include "debug.h" #include "dso.h" #include "evlist.h" #include "evsel.h" -#include "util/evsel_fprintf.h" -#include "header.h" +#include "evsel_fprintf.h" #include "memswap.h" -#include "trace-event.h" -#include "session.h" -#include "symbol.h" -#include "debug.h" -#include "cpumap.h" #include "pmu.h" #include "pmus.h" -#include "vdso.h" +#include "session.h" #include "strbuf.h" -#include "build-id.h" -#include "data.h" -#include <api/fs/fs.h> -#include <api/io_dir.h> -#include "asm/bug.h" -#include "tool.h" -#include "../perf.h" +#include "string2.h" +#include "symbol.h" #include "time-utils.h" +#include "tool.h" +#include "trace-event.h" #include "units.h" -#include "util/util.h" // perf_exe() -#include "cputopo.h" -#include "bpf-event.h" -#include "bpf-utils.h" -#include "clockid.h" -#include "cacheline.h" +#include "util.h" // perf_exe() +#include "vdso.h" -#include <linux/ctype.h> -#include <internal/lib.h> +#ifdef HAVE_LIBBPF_SUPPORT +#include <bpf/libbpf.h> +#endif #ifdef HAVE_LIBTRACEEVENT #include <event-parse.h> @@ -3903,7 +3907,8 @@ static int process_compressed(struct feat_fd *ff, * checks decomp_len + sizeof(struct decomp) against SIZE_MAX * before allocating, which handles 32-bit safety. */ - if (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096) { + if (env->comp_mmap_len && + (env->comp_mmap_len < 4096 || env->comp_mmap_len % 4096)) { pr_err("Invalid HEADER_COMPRESSED: comp_mmap_len (%u) must be a 4K-aligned value >= 4096\n", env->comp_mmap_len); return -1; -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read 2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers 2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers @ 2026-09-10 21:12 ` Ian Rogers 2026-09-10 21:12 ` [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers 2 siblings, 0 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel strim may advance the pointer assigned to cache->size which causes later frees to crash. Fix by performing the strim and then memmove-ing the potentially shifted string back over the original string. The bug was introduced by the transition from rtrim to strim, as rtrim wouldn't move on the left. Fixes: 13c230ab6e56 ("perf tools: Ditch rtrim(), use strim() from tools/lib") Signed-off-by: Ian Rogers <irogers@google.com> Assisted-by: Antigravity:gemini-3.1-pro --- tools/perf/util/header.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 974ce1c926cd..0a4236fc0293 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -1268,7 +1268,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev return -1; cache->type[len] = 0; - cache->type = strim(cache->type); + { + char *trimmed = strim(cache->type); + + memmove(cache->type, trimmed, strlen(trimmed) + 1); + } scnprintf(file, PATH_MAX, "%s/size", path); if (sysfs__read_str(file, &cache->size, &len)) { @@ -1277,7 +1281,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev } cache->size[len] = 0; - cache->size = strim(cache->size); + { + char *trimmed = strim(cache->size); + + memmove(cache->size, trimmed, strlen(trimmed) + 1); + } scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path); if (sysfs__read_str(file, &cache->map, &len)) { @@ -1287,7 +1295,11 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev } cache->map[len] = 0; - cache->map = strim(cache->map); + { + char *trimmed = strim(cache->map); + + memmove(cache->map, trimmed, strlen(trimmed) + 1); + } return 0; } -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents 2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers 2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers 2026-09-10 21:12 ` [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers @ 2026-09-10 21:12 ` Ian Rogers 2 siblings, 0 replies; 10+ messages in thread From: Ian Rogers @ 2026-09-10 21:12 UTC (permalink / raw) To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Jiri Olsa, Ian Rogers, Adrian Hunter, James Clark, Swapnil Sapkal, linux-perf-users, linux-kernel Avoid a checkpatch.pl warning on the use of asm/bug.h by switching the use of WARN macros to explicit tests and then using pr_warning from debug.h. Signed-off-by: Ian Rogers <irogers@google.com> --- tools/perf/util/header.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 0a4236fc0293..c7f2c29f02b0 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -8,7 +8,6 @@ #include <stdlib.h> #include <string.h> -#include <asm/bug.h> #include <byteswap.h> #include <dirent.h> #include <linux/bitops.h> @@ -385,8 +384,10 @@ static int do_read_bitmap(struct feat_fd *ff, unsigned long **pset, u64 *psize) static int write_tracing_data(struct feat_fd *ff, struct evlist *evlist __maybe_unused) { - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } #ifdef HAVE_LIBTRACEEVENT return read_tracing_data(ff->fd, &evlist__core(evlist)->entries); @@ -407,8 +408,10 @@ static int write_build_id(struct feat_fd *ff, if (!perf_session__read_build_ids(session, true)) return -1; - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } err = perf_session__write_buildid_table(session, ff); if (err < 0) { @@ -1014,8 +1017,10 @@ static int write_auxtrace(struct feat_fd *ff, struct perf_session *session; int err; - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } session = container_of(ff->ph, struct perf_session, header); @@ -1109,9 +1114,10 @@ static int write_dir_format(struct feat_fd *ff, session = container_of(ff->ph, struct perf_session, header); data = session->data; - if (WARN_ON(!perf_data__is_dir(data))) + if (!perf_data__is_dir(data)) { + pr_warning("Expected data to be a directory\n"); return -1; - + } return do_write(ff, &data->dir.version, sizeof(data->dir.version)); } @@ -3715,9 +3721,10 @@ static int process_dir_format(struct feat_fd *ff, session = container_of(ff->ph, struct perf_session, header); data = session->data; - if (WARN_ON(!perf_data__is_dir(data))) + if (!perf_data__is_dir(data)) { + pr_warning("Expected data to be a directory\n"); return -1; - + } return do_read_u64(ff, &data->dir.version); } @@ -4395,8 +4402,10 @@ static int do_write_feat(struct feat_fd *ff, int type, if (!feat_ops[type].write) return -1; - if (WARN(ff->buf, "Error: calling %s in pipe-mode.\n", __func__)) + if (ff->buf) { + pr_warning("Error: calling %s in pipe-mode.\n", __func__); return -1; + } (*p)->offset = lseek(ff->fd, 0, SEEK_CUR); -- 2.55.0.1007.g17ff1f9808-goog ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-09-10 21:12 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-09-10 17:37 [PATCH v1 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers 2026-09-10 17:37 ` [PATCH v1 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers 2026-09-10 17:37 ` [PATCH v1 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers 2026-09-10 17:56 ` [PATCH v2 1/3] perf test x86: Fix missing __msan_unpoison Ian Rogers 2026-09-10 17:56 ` [PATCH v2 2/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers 2026-09-10 17:56 ` [PATCH v2 3/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers 2026-09-10 21:12 ` [PATCH v3 0/3] perf header: Fix memory corruption and unnecessary warning Ian Rogers 2026-09-10 21:12 ` [PATCH v3 1/3] perf header: Fix HEADER_COMPRESSED validation for comp_mmap_len Ian Rogers 2026-09-10 21:12 ` [PATCH v3 2/3] perf header: Fix potential memory corruption in cpu_cache_level__read Ian Rogers 2026-09-10 21:12 ` [PATCH v3 3/3] perf header: Transition WARN macros to debug.h equivalents Ian Rogers
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®