github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf session: Use bounded copy for PERF_RECORD_TIME_CONV

Browse Source 
session->time_conv = event->time_conv copies sizeof(struct
perf_record_time_conv) bytes unconditionally, but older kernels
emit shorter TIME_CONV events without the time_cycles, time_mask,
cap_user_time_zero, and cap_user_time_short fields.

For a 32-byte event (the original format), this reads 24 bytes
past the event boundary into adjacent mmap'd data.  The garbage
values end up in session->time_conv and can cause incorrect TSC
conversion if cap_user_time_zero happens to be non-zero.

Replace the struct assignment with a bounded memcpy capped at
event->header.size, zeroing the remainder so extended fields
default to off when absent.

Reported-by: sashiko-bot@kernel.org # Running on a local machine
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6-1m
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Arnaldo Carvalho de Melo 2026-05-06 17:00:50 -03:00
parent 981f13ae62
commit 3ade633da7
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
tools/perf/util/session.c
View File

@ -1897,7 +1897,14 @@ static s64 perf_session__process_user_event(struct perf_session *session,
err = tool->stat_round(tool, session, event);
break;
case PERF_RECORD_TIME_CONV:
session->time_conv = event->time_conv;
/*
* Bounded copy: older kernels emit a shorter struct
* without time_cycles/time_mask/cap_user_time_*.
* Zero the rest so extended fields default to off.
*/
memset(&session->time_conv, 0, sizeof(session->time_conv));
memcpy(&session->time_conv, &event->time_conv,
min((size_t)event->header.size, sizeof(session->time_conv)));
err = tool->time_conv(tool, session, event);
break;
case PERF_RECORD_HEADER_FEATURE: