github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

Browse Source 
machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail.  Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.

Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.

Fixes: 0c4c4debb0 ("perf tools: Add processor socket info to hist_entry and addr_location")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Arnaldo Carvalho de Melo 2026-06-06 20:57:49 -03:00
parent 7953a3a9b8
commit 5484b43a0e
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
tools/perf/util/event.c
View File

@ -14,6 +14,7 @@
#include <linux/perf_event.h>
#include "cpumap.h"
#include "dso.h"
#include "env.h"
#include "event.h"
#include "debug.h"
#include "hist.h"
@ -836,8 +837,18 @@ int machine__resolve(struct machine *machine, struct addr_location *al,
if (al->cpu >= 0) {
struct perf_env *env = machine->env;
if (env && env->cpu)
al->socket = env->cpu[al->cpu].socket_id;
/*
* Bounds-check al->cpu (s32) before casting to struct perf_cpu
* (int16_t): without this, e.g. 65536 truncates to 0 and silently
* returns CPU 0's topology. Can go once perf_cpu.cpu is widened.
*/
if (env && al->cpu < env->nr_cpus_avail) {
struct cpu_topology_map *topo;
topo = perf_env__get_cpu_topology(env, (struct perf_cpu){ al->cpu });
if (topo)
al->socket = topo->socket_id;
}
}
/* Account for possible out-of-order switch events. */