perf tools: Add bounds check to cpu__get_node()

cpu__get_node() accesses cpunode_map[cpu.cpu] without checking against
max_cpu_num, the allocation size of cpunode_map.  Callers such as
builtin-kmem.c:evsel__process_alloc_event() pass sample->cpu from
perf.data events, which may exceed the host's CPU count when analyzing
cross-machine recordings.

Add a bounds check against max_cpu_num before indexing, returning -1
for out-of-range values.  This is a central fix that protects all
callers.

Fixes: 86895b480a ("perf stat: Add --per-node agregation support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Arnaldo Carvalho de Melo 2026-06-04 18:14:23 -03:00
parent 7ccd2e6cec
commit 1e7921d722

View File

@ -576,6 +576,10 @@ int cpu__get_node(struct perf_cpu cpu)
return -1;
}
/* cpunode_map allocated for max_cpu_num entries; input may be untrusted */
if (cpu.cpu < 0 || cpu.cpu >= max_cpu_num.cpu)
return -1;
return cpunode_map[cpu.cpu];
}