]> git.ipfire.org Git - thirdparty/linux.git/commit
perf kwork: Bounds check work->cpu before indexing cpus_runtime[]
authorArnaldo Carvalho de Melo <acme@redhat.com>
Sun, 3 May 2026 16:05:51 +0000 (13:05 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Fri, 29 May 2026 14:44:35 +0000 (11:44 -0300)
commit48d004c0742dcbc940ffb3b7390540c5a200729e
tree3df923320b81cfcec16141be5d85d52fe7b3af52
parenta2e59fb79f449fb43ca277a413f1e1de3c3a6326
perf kwork: Bounds check work->cpu before indexing cpus_runtime[]

work->cpu comes from sample->cpu which is (u32)-1 when
PERF_SAMPLE_CPU is absent.  Stored as int, this becomes -1
which passes the signed BUG_ON(work->cpu >= MAX_NR_CPUS) but
causes an out-of-bounds access on cpus_runtime[-1].

Replace the BUG_ON in top_calc_total_runtime() with an unsigned
bounds check that skips entries with invalid CPU values, counting
them for a summary warning.

Guard the same index in profile_event_match() (bitmap OOB),
top_calc_idle_time(), top_calc_irq_runtime(), top_calc_cpu_usage(),
and top_calc_load_runtime().  Also guard against division by zero
in top_calc_cpu_usage() when no runtime was accumulated.

Reported-by: sashiko-bot@kernel.org # Running on a local machine
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Yang Jihong <yangjihong@bytedance.com>
Assisted-by: Claude:claude-opus-4.6-1m
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/builtin-kwork.c
tools/perf/util/kwork.h