On Wed, Aug 5, 2026 at 6:31 AM Arnaldo Carvalho de Melo <acme@kernel.org> wrote:
>
> From: Arnaldo Carvalho de Melo <acme@redhat.com>
>
> jit_open() sets bsz = bs before the fread() that uses bs - bsz as the
> read size, making the expression always evaluate to zero.  fread() with
> size 0 returns 0, which triggers the ret != 1 error path — so extended
> jitdump headers (total_size > sizeof(header)) have been silently broken
> since the original implementation.
>
> Additionally, when 0 < bs <= bsz the if (bs > bsz) block is skipped
> entirely, leaving extended header bytes unread in the stream.  Subsequent
> jit_get_next_entry() calls then parse those leftover bytes as a
> jr_prefix, corrupting the record stream.
>
> Fix by separating the buffer growth from the read: realloc only when
> bs > bsz, then unconditionally fread bs bytes when bs > 0.
>
> Fixes: 9b07e27f88b9cd78 ("perf inject: Add jitdump mmap injection support")
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Cc: Stephane Eranian <eranian@google.com>
> Cc: Ian Rogers <irogers@google.com>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Reviewed-by: Ian Rogers <irogers@google.com>

Thanks!
Ian

> ---
>  tools/perf/util/jitdump.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
> index 83005b30b9bf3fd7..4b7c7ba7cd95ddbb 100644
> --- a/tools/perf/util/jitdump.c
> +++ b/tools/perf/util/jitdump.c
> @@ -224,10 +224,12 @@ jit_open(struct jit_buf_desc *jd, const char *name)
>                 n = realloc(buf, bs);
>                 if (!n)
>                         goto error;
> -               bsz = bs;
>                 buf = n;
> -               /* read extra we do not know about */
> -               ret = fread(buf, bs - bsz, 1, jd->in);
> +               bsz = bs;
> +       }
> +       if (bs > 0) {
> +               /* consume extended header bytes from the stream */
> +               ret = fread(buf, bs, 1, jd->in);
>                 if (ret != 1)
>                         goto error;
>         }
> --
> 2.55.0
>