Re: [PATCH] perf powerpc-vpadtl: Fix off-by-one in auxtrace_info minimum size check

[Arnaldo Carvalho de Melo]

On Mon, Aug 24, 2026 at 08:55:52AM +0300, Adrian Hunter wrote:
> On 24/08/2026 05:55, Wang Yan wrote:
> > min_sz is set to sizeof(u64) * POWERPC_VPADTL_TYPE, but the code reads
> > auxtrace_info->priv[POWERPC_VPADTL_TYPE], which needs at least
> > POWERPC_VPADTL_TYPE + 1 elements.  POWERPC_VPADTL_TYPE is the first
> > enumerator of the priv index enum (0), so min_sz evaluates to 0 and the
> > check validates only the perf_record_auxtrace_info header itself.  A
> > PERF_RECORD_AUXTRACE_INFO event carrying a zero-length priv array then
> > passes the size check, and the subsequent priv[POWERPC_VPADTL_TYPE]
> > read runs one u64 past the validated region.
> > 
> > This is the same off-by-one fixed for Intel PT by commit c4362d5e1a5e
> > ("perf intel-pt: Fix off-by-one in auxtrace_info minimum size check")
> > and for Intel BTS by commit b9fb8225951c ("perf intel-bts: Fix off-by-one
> > in auxtrace_info minimum size check").
> > 
> > Use sizeof(u64) * (POWERPC_VPADTL_TYPE + 1) so the highest accessed
> > priv index is covered by the minimum-size validation.
> > 
> > Fixes: c4bbd4ec2e50 ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Wang Yan <wangyan01@xxxxxxxxxx>
> 
> Reviewed-by: Adrian Hunter <adrian.hunter@xxxxxxxxx>

Thanks, applied to perf-tools-next, for v7.4.

- Arnaldo