kernel/linux.git/tools/perf/util/header.c, branch v7.1.7

perf bpf: Validate array presence before casting BPF prog info pointers

2026-07-24T14:20:17+00:00

[ Upstream commit 5ebf4137d23a4fd6c0cc6a6fb766ee60d2b09193 ] Several functions cast bpf_prog_info fields (jited_ksyms, jited_func_lens, jited_prog_insns) from u64 to pointers and dereference them. These fields are only valid pointers if bpil_offs_to_addr() converted their file offsets to addresses, which only happens when the corresponding PERF_BPIL_* bits are set in info_linear->arrays. A crafted perf.data can leave these bits unset while setting non-zero counts and offset values, causing the functions to dereference raw file offsets as pointers. Add array bitmask validation to all perf.data processing paths: - __bpf_event__print_bpf_prog_info(): check JITED_KSYMS and JITED_FUNC_LENS (changed to take struct perf_bpil *) - machine__process_bpf_event_load(): check JITED_KSYMS - bpf_read(): check JITED_INSNS before memcpy from jited_prog_insns - dso__disassemble_filename(): check JITED_INSNS before returning jited_prog_insns pointer Fixes: f8dfeae009effc0b ("perf bpf: Show more BPF program info in print_bpf_prog_info()") Reported-by: sashiko-bot Cc: Song Liu Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin

perf header: Validate bitmap size before allocating in do_read_bitmap()

2026-07-24T14:20:03+00:00

[ Upstream commit 3669697bda41c562d90eb38f54881cc02ef3d51c ] do_read_bitmap() reads a u64 bit count from the file and passes it to bitmap_zalloc() without checking it against the remaining section size. A crafted perf.data could trigger a large allocation that would only fail later when the per-element reads exceed section bounds. Additionally, bitmap_zalloc() takes an int parameter, so a crafted size with bits set above bit 31 (e.g. 0x100000040) would pass the section bounds check but truncate when passed to bitmap_zalloc(), allocating a much smaller buffer than the subsequent read loop expects. Reject size values that exceed INT_MAX, and check that the data needed (BITS_TO_U64(size) u64 values) fits in the remaining section before allocating. Switch from bitmap_zalloc() to calloc() of u64 units so the allocation size matches the u64 read/write granularity and avoids unsigned long vs u64 mismatch on 32-bit architectures. Fix do_write_bitmap() to use memcpy to read u64-sized chunks from the unsigned long bitmap, preventing out-of-bounds reads on 32-bit systems where sizeof(unsigned long) is 4 but the bitmap is stored in u64 units. Fix process_mem_topology() minimum section size: the check used nr * 2 * sizeof(u64) per node, but do_read_bitmap() reads an additional u64 for the bitmap size, so the minimum is 3 * sizeof(u64). Fix memory leak in process_mem_topology() error paths: replace free(nodes) with memory_node__delete_nodes() to free per-node bitmaps allocated by do_read_bitmap(). Currently used by process_mem_topology() for HEADER_MEM_TOPOLOGY. Fixes: a881fc56038a ("perf header: Sanity check HEADER_MEM_TOPOLOGY") Closes: https://lore.kernel.org/linux-perf-users/20260414224622.2AE69C19425@smtp.kernel.org/ Closes: https://lore.kernel.org/linux-perf-users/20260410223242.DD76FC19421@smtp.kernel.org/ Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin

perf header: Sanity check HEADER_EVENT_DESC attr.size before swap

2026-07-24T14:20:03+00:00

[ Upstream commit 944f65c8b8231d26d4db6be67bcb641142603cb4 ] read_event_desc() reads nre (event count), sz (attr size), and nr (IDs per event) from the file and uses them to control allocations and loops without validating them against the section size. A crafted perf.data could trigger large allocations or many loop iterations before __do_read() eventually rejects the reads. Add bounds checks in read_event_desc(): - Reject sz smaller than PERF_ATTR_SIZE_VER0. - Require at least one event (nre > 0). - Check that nre events fit in the remaining section, using the minimum per-event footprint of sz + sizeof(u32). - Pre-swap attr->size to native byte order, then reject values below PERF_ATTR_SIZE_VER0 or above sz before calling perf_event__attr_swap() to prevent heap out-of-bounds access. - Handle ABI0 (attr.size == 0): substitute PERF_ATTR_SIZE_VER0, and on native-endian files write the value back so free_event_desc() does not treat the zero as its end-of-array sentinel (it iterates while attr.size != 0). The swap path skips the write-back — perf_event__attr_swap() has its own ABI0 fallback that sets VER0 after swapping. - Check that nr IDs fit in the remaining section before allocating. Fixes: b30b61729246 ("perf tools: Fix a problem when opening old perf.data with different byte order") Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin

perf header: Add sanity checks to HEADER_BPF_BTF processing

2026-04-14T06:21:53+00:00

Validate the BTF entry count and individual data sizes when reading HEADER_BPF_BTF from perf.data files to prevent excessive memory allocation from malformed files. Reuses the MAX_BPF_PROGS (131072) and MAX_BPF_DATA_LEN (256 MB) limits from HEADER_BPF_PROG_INFO processing. Cc: Song Liu Cc: Jiri Olsa Cc: Namhyung Kim Cc: Ian Rogers Cc: Adrian Hunter Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim

perf header: Sanity check HEADER_BPF_PROG_INFO

2026-04-14T06:21:53+00:00

Add validation to process_bpf_prog_info() to harden against malformed perf.data files: - Upper bound on BPF program count (max 131072) - Upper bound on per-program data_len (max 256MB) Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim

perf header: Sanity check HEADER_PMU_CAPS

2026-04-14T06:21:53+00:00

Add upper bound checks in PMU capabilities processing to harden against malformed perf.data files: - nr_pmu bounded to MAX_PMU_MAPPINGS (4096) in process_pmu_caps() - nr_pmu_caps bounded to MAX_PMU_CAPS (512) in __process_pmu_caps() Cc: Ravi Bangoria Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim

perf header: Sanity check HEADER_HYBRID_TOPOLOGY

2026-04-14T06:21:53+00:00

Add upper bound check on nr_nodes in process_hybrid_topology() to harden against malformed perf.data files (reuses MAX_PMU_MAPPINGS, 4096). Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim

perf header: Sanity check HEADER_CACHE

2026-04-14T06:21:53+00:00

Add upper bound check on cache entry count in process_cache() to harden against malformed perf.data files (max 32768). Cc: Jiri Olsa Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim

perf header: Sanity check HEADER_GROUP_DESC

2026-04-14T06:21:53+00:00

Add upper bound check on nr_groups in process_group_desc() to harden against malformed perf.data files (max 32768), and move the env assignment after validation. Cc: Namhyung Kim Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim

perf header: Sanity check HEADER_PMU_MAPPINGS

2026-04-14T06:21:53+00:00

Add upper bound check on pmu_num in process_pmu_mappings() to harden against malformed perf.data files (max 4096). Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim