kernel/linux.git/tools/perf/util/session.c, branch v7.2-rc1

perf machine: Propagate machine__init() error to callers

2026-06-17T12:21:03+00:00

machine__init() always returns 0 even when memory allocation fails, because commit 81f981d7ec43ed93 ("perf machine: Free root_dir in machine__init() error path") introduced 'int err = -ENOMEM' and an error cleanup path but left the final 'return 0' instead of 'return err'. Fix by returning err, check the return value in __machine__new_host() which was ignoring it, and change machines__init() from void to int so it too can propagate the error to perf_session__new(), aslr_tool__init() and test callers. The error cleanup also used zfree(&machine->kmaps), but kmaps is a refcounted maps structure — use maps__zput() to properly drop the reference, matching machine__exit(). Move dsos__init() and threads__init() before the first fallible allocation (maps__new) so that machine__exit() is safe to call on any machine struct that machine__init() touched, even on early failure. Fixes: 81f981d7ec43ed93 ("perf machine: Free root_dir in machine__init() error path") Reported-by: sashiko-bot Cc: Ian Rogers Cc: Jiri Olsa Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo

perf env: Add perf_env__e_machine helper and use in perf_env__arch

2026-06-03T19:42:52+00:00

Add a helper that lazily computes the e_machine and falls back to EM_HOST. Use the perf_env's arch to compute the e_machine if available, using a binary search for efficiency while handling duplicate rules. Switch perf_env__arch to be derived from e_machine for consistency. To support 32-bit compat binaries on 64-bit hosts during dynamic local or live operations, unpopulated arch fallback paths query uname() at runtime to dynamically resolve the correct host e_machine, safely preventing bitness misclassification regressions. Update session and header to use the helper to safely record e_machine and flags without forcing premature thread scanning. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Honglei Wang Cc: Jan Polensky Cc: Sumanth Korikkar Cc: Thomas Richter Cc: Vasily Gorbik Signed-off-by: Arnaldo Carvalho de Melo

perf session: Include file offset in event skip/stop messages

2026-06-03T19:31:03+00:00

Add 'at offset %#' to all warning and error messages in session.c that fire when events are skipped or processing stops due to validation failures. This lets users cross-reference with 'perf report -D' output to inspect the surrounding records and understand the corruption context. Covers messages in perf_session__process_event() (alignment, min size, swap failure), perf_session__deliver_event() (no evsel, parse failure, CPU clamping), machines__deliver_event() (NAMESPACES, TEXT_POKE, null-terminated string checks for MMAP/MMAP2/COMM/CGROUP/KSYMBOL), and perf_session__process_user_event() (THREAD_MAP, CPU_MAP, STAT_CONFIG, BPF_METADATA, HEADER_BUILD_ID). Reviewed-by: Ian Rogers Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo

perf sample: Add file_offset field to struct perf_sample

2026-06-03T19:31:03+00:00

Add a file_offset field to struct perf_sample so that event processing callbacks can report the byte offset of the problematic event in perf.data, letting users cross-reference with 'perf report -D' output. Set sample.file_offset in perf_session__deliver_event(), which is the common entry point for both file mode (mmap'd offset) and pipe mode (running byte counter from __perf_session__process_pipe_events). The assignment is placed after evsel__parse_sample(), which zeroes the struct via memset. Preserve file_offset through the deferred callchain delivery path by storing it in struct deferred_event and restoring it after evlist__parse_sample() in both evlist__deliver_deferred_callchain() and session__flush_deferred_samples(). Subsequent patches will use this field in skip/stop warning messages. Reviewed-by: Ian Rogers Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo

perf session: Snapshot event->header.size in process_user_event()

2026-05-29T14:44:35+00:00

On native-endian files, events are read from MAP_SHARED memory. Multiple reads of event->header.size can return different values if the file is concurrently modified, allowing an attacker to bypass bounds checks performed on an earlier read. Snapshot header.size into a local variable at function entry using READ_ONCE() to prevent compiler rematerialization, and use it for all size-dependent arithmetic within the function. This ensures every bounds calculation uses the same value that was validated by the reader. Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo

perf session: Bound nr_cpus_avail and validate sample CPU

2026-05-29T14:44:35+00:00

Several downstream consumers (timechart, kwork, sched) use fixed-size arrays indexed by CPU. A crafted perf.data can supply arbitrary CPU values that index past these arrays, causing out-of-bounds access. Validate sample.cpu against min(nr_cpus_avail, MAX_NR_CPUS) in perf_session__deliver_event() before any tool callback runs. The cap at MAX_NR_CPUS protects fixed-size downstream arrays; the true nr_cpus_avail is preserved in env for header parsing (e.g. process_cpu_topology) which needs the real count. Fall back to MAX_NR_CPUS when HEADER_NRCPUS is missing (truncated files, pipe mode, pre-2017 perf). Only validate when PERF_SAMPLE_CPU is set in sample_type — when absent, evsel__parse_sample() leaves sample.cpu as (u32)-1, a sentinel that downstream tools (script, inject) check to identify events without CPU info. Clamping it to 0 would break those checks. Inline evlist__parse_sample() into perf_session__deliver_event() so the evsel lookup needed for sample_type checking reuses the same evsel that parsed the sample, avoiding a second evlist__event2evsel() call on every event. For pipe-mode streams where HEADER_NRCPUS may arrive late or not at all, the MAX_NR_CPUS fallback ensures the bounds check is still effective against the fixed-size downstream arrays. Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo

perf session: Add byte-swap handler for PERF_RECORD_COMPRESSED2

2026-05-29T14:44:34+00:00

PERF_RECORD_COMPRESSED2 events carry a data_size field that must be byte-swapped when reading cross-endian perf.data files. Without a swap handler, reading COMPRESSED2 events on a different-endian machine would misinterpret data_size as a garbage value, causing the decompression path to read the wrong number of bytes. The compressed payload itself is a raw byte stream and needs no swapping. Fixes: 208c0e16834472bb ("perf record: Add 8-byte aligned event type PERF_RECORD_COMPRESSED2") Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Adrian Hunter Cc: Chun-Tse Shao Cc: Jiri Olsa Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo

perf header: Validate null-termination in PERF_RECORD_EVENT_UPDATE string fields

2026-05-29T14:44:33+00:00

strdup(ev->unit) and strdup(ev->name) read until '\0' with no guarantee the string is null-terminated within event->header.size. The dump_trace fprintf path has the same problem with %s. Validate before either path runs — same class of bug fixed for MMAP/MMAP2/COMM/CGROUP by perf_event__check_nul(). Also harden the event_update swap handler to: - Validate SCALE event size before swapping the double at offset 24, which exceeds the 24-byte min_size. - Validate CPUS event size before accessing the cpu_map type/nr/long_size fields, which also start at the min_size boundary. - Swap CPUS variant fields (type, nr, long_size) so the processing path sees native byte order. Add validation in perf_event__process_event_update() for all event update variants (UNIT, NAME, SCALE, CPUS) before dump_trace or processing. Validate CPUS nr against payload size for both PERF_CPU_MAP__CPUS and PERF_CPU_MAP__MASK types on the fprintf (dump_trace) path: - CPUS: check nr does not exceed available cpu entries - MASK: check nr does not exceed available mask entries for both mask32 (long_size == 4) and mask64 (long_size == 8) layouts, with underflow guards on the offsetof subtraction Fix a missing break before the default case in the CPUS switch path. Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo

perf session: Add byte-swap and bounds check for PERF_RECORD_BPF_METADATA events

2026-05-29T14:44:33+00:00

PERF_RECORD_BPF_METADATA has no entry in perf_event__swap_ops[], so its nr_entries field is never byte-swapped when reading a cross-endian perf.data file. Downstream processing in perf_event__fprintf_bpf_metadata() loops over nr_entries, so a foreign-endian value causes out-of-bounds reads. Add a swap handler that byte-swaps nr_entries after validating that header.size is large enough. The entries[] array contains only char arrays (key/value strings), so no per-entry swap is needed — but ensure NUL-termination on the writable cross-endian path. Validate header.size, nr_entries, and string NUL-termination in the common event delivery path so that native-endian files with malicious values are also rejected. Snapshot nr_entries via READ_ONCE() before validation — the event is on a MAP_SHARED mmap that could theoretically change between the bounds check and the loop. Changes in v2: - Snapshot event->header.size via READ_ONCE() into a local variable to prevent a double-fetch underflow in the max_entries calculation (Reported-by: sashiko-bot@kernel.org) - Write back clamped nr_entries to the event on the swap path, consistent with NAMESPACES and STAT_CONFIG handlers — without writeback the native path sees the inflated nr and skips the event entirely (Reported-by: sashiko-bot@kernel.org) Fixes: ab38e84ba9a8 ("perf record: collect BPF metadata from existing BPF programs") Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Blake Jones Cc: Jiri Olsa Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo

perf auxtrace: Harden auxtrace_error event handling

2026-05-29T14:44:33+00:00

Fix four issues in PERF_RECORD_AUXTRACE_ERROR handling: 1. auxtrace_error_name() takes a signed int parameter, but e->type is __u32. A crafted value like 0xFFFFFFFF converts to -1, passes the bounds check, and causes a negative array index. Fix by changing the parameter to unsigned int. 2. The msg field is printed via %s without a length bound. The min_size table only guarantees fields up to msg (offset 48), so a truncated event has zero msg bytes within the event boundary. Compute the available msg length from header.size, cap at sizeof(e->msg), and use %.*s. 3. fmt >= 2 adds machine_pid and vcpu fields after msg[64]. Older files may have fmt >= 2 but an event size that doesn't include these fields. Add a size check in the swap handler to downgrade fmt before the conditional field access, and a matching size guard in the fprintf path for native-endian events (which are mmap'd read-only and can't be modified in place). 4. python_process_auxtrace_error() had the same issues: msg was passed to tuple_set_string() unbounded, and machine_pid/vcpu were accessed unconditionally without checking fmt or event size. Apply the same bounds checks. Reported-by: sashiko-bot@kernel.org # Running on a local machine Reviewed-by: Ian Rogers Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6-1m Signed-off-by: Arnaldo Carvalho de Melo