perf python: Check if there is space to copy all the event
[ Upstream commit89aaeaf842] The pyrf_event__new() method copies the event obtained from the perf ring buffer to a structure that will then be turned into a python object for further consumption, so it copies perf_event.header.size bytes to its 'event' member: $ pahole -C pyrf_event /tmp/build/perf-tools-next/python/perf.cpython-312-x86_64-linux-gnu.so struct pyrf_event { PyObject ob_base; /* 0 16 */ struct evsel * evsel; /* 16 8 */ struct perf_sample sample; /* 24 312 */ /* XXX last struct has 7 bytes of padding, 2 holes */ /* --- cacheline 5 boundary (320 bytes) was 16 bytes ago --- */ union perf_event event; /* 336 4168 */ /* size: 4504, cachelines: 71, members: 4 */ /* member types with holes: 1, total: 2 */ /* paddings: 1, sum paddings: 7 */ /* last cacheline: 24 bytes */ }; $ It was doing so without checking if the event just obtained has more than that space, fix it. This isn't a proper, final solution, as we need to support larger events, but for the time being we at least bounds check and document it. Fixes:877108e42b("perf tools: Initial python binding") Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Reviewed-by: Ian Rogers <irogers@google.com> Link: https://lore.kernel.org/r/20250312203141.285263-7-acme@kernel.org Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
committed by
Greg Kroah-Hartman
parent
69abc75544
commit
ccf40f8263
@@ -585,6 +585,11 @@ static PyObject *pyrf_event__new(union perf_event *event)
|
||||
event->header.type == PERF_RECORD_SWITCH_CPU_WIDE))
|
||||
return NULL;
|
||||
|
||||
// FIXME this better be dynamic or we need to parse everything
|
||||
// before calling perf_mmap__consume(), including tracepoint fields.
|
||||
if (sizeof(pevent->event) < event->header.size)
|
||||
return NULL;
|
||||
|
||||
ptype = pyrf_event__type[event->header.type];
|
||||
pevent = PyObject_New(struct pyrf_event, ptype);
|
||||
if (pevent != NULL)
|
||||
|
||||
Reference in New Issue
Block a user