[sstamenk]

Motivation

rocprofiler-sdk bundles ELFIO through its external/elfio submodule and uses it in both standalone and TheRock builds (ROCPROFILER_BUILD_ELFIO defaults to ON). Upstream ELFIO has out-of-bounds reads and unbounded loops in symbol hash table lookup and note parsing. The fixes are in review upstream (serge1/ELFIO#174, serge1/ELFIO#173), but ELFIO has had no release since 3.12 (2023), so the SDK needs to carry them until they land.

Same fixes in CLR's ELFIO copy: #10982, #10979.

Technical Details

• Move the external/elfio submodule from 575bfdb to upstream main (660e905), which is the base of both upstream PRs, so the patches are the upstream changes verbatim. The non-git fallback clone now checks out the same commit instead of Release_3.12, so git and non-git builds use the same ELFIO.
• Add external/patches/elfio/0001-Validate-note-accessor-bounds.patch and 0002-Validate-symbol-hash-table-bounds.patch. Each names its upstream PR and should be removed once the submodule moves to a commit that includes it.
• ELFIO is header-only. At configure time, copy its headers to the build tree, apply the patches there, and expose the result as elfio::elfio, replacing add_subdirectory(elfio), which only defined that header-only target. The submodule stays unmodified.
  • Patched headers are only rewritten when their content changes, so reconfiguring doesn't trigger rebuilds.
  • Configure reruns automatically when a patch or submodule header changes.
  • A patch that fails to apply stops configuration with the patch output.
• Builds with ROCPROFILER_BUILD_ELFIO=OFF keep using the external ELFIO package unchanged.

JIRA ID

SWSPLAT-24296, SWSPLAT-24318

Test Plan

• Configure and build rocprofiler-sdk with GCC 13 against an installed ROCm, and check that the ELFIO users (rocprofiler-sdk-common-library, rocprofiler-sdk-rocattach-shared-library) compile only against the patched headers.
• Check that the patched headers match the upstream PR heads.
• Run rocattach-symbol-lookup-test, whose fixtures cover both GNU (--hash-style=gnu) and SysV (--hash-style=sysv) hash tables.
• Run rocprofv3 --kernel-trace on the transpose sample on gfx1100.
• In a standalone project using the same CMake block, check that:
  • an unchanged reconfigure leaves the patched headers untouched;
  • editing a patch re-runs configure;
  • a patch that doesn't apply fails configure with a clear message.

Test Result

• Build: passed, with no warnings from the ELFIO headers. Compile lines contain only the build-tree elfio-patched include, never the submodule.
• Patched elfio_note.hpp and elfio_symbols.hpp match Validate note accessor bounds serge1/ELFIO#173 and Disabling temp. the call to OMPT Tool Finalize #174 byte for byte.
• rocattach-symbol-lookup-test: passed.
• rocprofv3 --kernel-trace: passed on a ROCm runtime containing fix(rocr): fix out-of-bounds access in hsa_amd_signal_wait_any #8564 (TheRock nightly 2026-10-07), with queue interposition active. That was 53 rows for 1 thread × 50 iterations and 1,005 rows for 2 threads × 500 iterations, across all visible GPUs. The baseline (unpatched) SDK gives identical results.
• CMake edge cases: all passed.
• cmake-format 0.6.13 with the SDK's .cmake-format.yaml: clean.

Note: on an older ROCm runtime (7.15), rocprofv3 aborts with heap corruption, with or without this change. The cause is the hsa_amd_signal_wait_any out-of-bounds write fixed in #8564, which the SDK's queue-interposition completion monitor hits whenever its wake signal (last slot) fires. That's unrelated to ELFIO; ROCPROFILER_QUEUE_INTERPOSITION=0 avoids it on such runtimes.

Submission Checklist

• Reviewed the contributing guidelines.

Prepared with AI assistance.

🤖 Generated with Claude Code

[therock-pr-bot]

✅ All Policy Checks Passed

Check	Status	Details
📝 PR Description	✅ Pass	—
⛔ Forbidden Files	✅ Pass	—
🧪 Unit Test	✅ Pass	PR does not contain code files — Unit Test auto-passed
🚫 Draft PR	🔜 To Be Enabled	—
🚩 Feature Flag	🔜 To Be Enabled	—
📊 Code Coverage	🔜 To Be Enabled	—

🎉 All policy checks passed!

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

🙋 Wish to Override Policy?