perf header: Sanity check HEADER_EVENT_DESC attr.size before swap

read_event_desc() reads nre (event count), sz (attr size), and nr
(IDs per event) from the file and uses them to control allocations
and loops without validating them against the section size.

A crafted perf.data could trigger large allocations or many loop
iterations before __do_read() eventually rejects the reads.

Add bounds checks in read_event_desc():
- Reject sz smaller than PERF_ATTR_SIZE_VER0.
- Require at least one event (nre > 0).
- Check that nre events fit in the remaining section, using the
  minimum per-event footprint of sz + sizeof(u32).
- Pre-swap attr->size to native byte order, then reject values
  below PERF_ATTR_SIZE_VER0 or above sz before calling
  perf_event__attr_swap() to prevent heap out-of-bounds access.
- Handle ABI0 (attr.size == 0): substitute PERF_ATTR_SIZE_VER0,
  and on native-endian files write the value back so
  free_event_desc() does not treat the zero as its end-of-array
  sentinel (it iterates while attr.size != 0).  The swap path
  skips the write-back — perf_event__attr_swap() has its own
  ABI0 fallback that sets VER0 after swapping.
- Check that nr IDs fit in the remaining section before allocating.

Fixes: b30b61729246 ("perf tools: Fix a problem when opening old perf.data with different byte order")
Reported-by: sashiko-bot@kernel.org # Running on a local machine
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Assisted-by: Claude:claude-opus-4.6-1m
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 90417a478c8db2e1532e889f155d6283ba223276..37d7c9849e0e91993d05ad840a763cc7eafcedbc 100644 (file)
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -2173,9 +2173,28 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
        if (do_read_u32(ff, &nre))
                goto error;
 
+       /* Size of each of the nre attributes. */
        if (do_read_u32(ff, &sz))
                goto error;
 
+       /*
+        * Require at least one event with an attr no smaller than the
+        * first published struct, and reject sz values where
+        * sz + sizeof(u32) would overflow size_t (possible on 32-bit)
+        * or nre == UINT32_MAX where nre + 1 wraps to 0 in the calloc.
+        *
+        * The minimum section footprint per event is sz bytes for the
+        * attr plus a u32 for the id count, check that nre events fit.
+        */
+       if (!nre || sz < PERF_ATTR_SIZE_VER0 ||
+           sz > ff->size || (size_t)sz > SIZE_MAX - sizeof(u32) ||
+           nre == UINT32_MAX ||
+           nre > (ff->size - ff->offset) / (sz + sizeof(u32))) {
+               pr_err("Invalid HEADER_EVENT_DESC: nre=%u sz=%u (min %d)\n",
+                      nre, sz, PERF_ATTR_SIZE_VER0);
+               goto error;
+       }
+
        /* buffer to hold on file attr struct */
        buf = malloc(sz);
        if (!buf)
@@ -2191,6 +2210,9 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
                msz = sz;
 
        for (i = 0, evsel = events; i < nre; evsel++, i++) {
+               struct perf_event_attr *attr = buf;
+               u32 attr_size;
+
                evsel->core.idx = i;
 
                /*
@@ -2200,6 +2222,32 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
                if (__do_read(ff, buf, sz))
                        goto error;
 
+               /* Reject before attr_swap to prevent OOB via bswap_safe() */
+               attr_size = ff->ph->needs_swap ? bswap_32(attr->size) : attr->size;
+               /* ABI0: size == 0 means the producer didn't set it */
+               if (!attr_size) {
+                       attr_size = PERF_ATTR_SIZE_VER0;
+                       /*
+                        * Write back so free_event_desc() doesn't
+                        * treat this event as the end-of-array sentinel
+                        * (it iterates while attr.size != 0).
+                        *
+                        * Only for native — the swap path must NOT
+                        * write native-endian VER0 here because
+                        * perf_event__attr_swap() would re-swap it
+                        * to 0x40000000, defeating bswap_safe() bounds.
+                        * perf_event__attr_swap() has its own ABI0
+                        * fallback that sets VER0 after swapping.
+                        */
+                       if (!ff->ph->needs_swap)
+                               attr->size = attr_size;
+               }
+               if (attr_size < PERF_ATTR_SIZE_VER0 || attr_size > sz) {
+                       pr_err("Event %d attr.size (%u) invalid (min: %d, max: %u)\n",
+                              i, attr_size, PERF_ATTR_SIZE_VER0, sz);
+                       goto error;
+               }
+
                if (ff->ph->needs_swap)
                        perf_event__attr_swap(buf);
 
@@ -2221,6 +2269,12 @@ static struct evsel *read_event_desc(struct feat_fd *ff)
                if (!nr)
                        continue;
 
+               /* Prevent oversized allocation from crafted nr */
+               if (nr > (ff->size - ff->offset) / sizeof(*id)) {
+                       pr_err("Event %d: id count %u exceeds remaining section\n", i, nr);
+                       goto error;
+               }
+
                id = calloc(nr, sizeof(*id));
                if (!id)
                        goto error;