]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
perf session: Use bounded copy for PERF_RECORD_TIME_CONV
authorArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 6 May 2026 20:00:50 +0000 (17:00 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Fri, 29 May 2026 14:44:32 +0000 (11:44 -0300)
commit3ade633da7aa58e2a643c9eb0686c91d7dfa4f4e
tree65c382914fed3c4520a8c53f2d15dd85de34401f
parent981f13ae6255fe8e9e68ca6435cd8194446460ec
perf session: Use bounded copy for PERF_RECORD_TIME_CONV

session->time_conv = event->time_conv copies sizeof(struct
perf_record_time_conv) bytes unconditionally, but older kernels
emit shorter TIME_CONV events without the time_cycles, time_mask,
cap_user_time_zero, and cap_user_time_short fields.

For a 32-byte event (the original format), this reads 24 bytes
past the event boundary into adjacent mmap'd data.  The garbage
values end up in session->time_conv and can cause incorrect TSC
conversion if cap_user_time_zero happens to be non-zero.

Replace the struct assignment with a bounded memcpy capped at
event->header.size, zeroing the remainder so extended fields
default to off when absent.

Reported-by: sashiko-bot@kernel.org # Running on a local machine
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6-1m
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/session.c