]> git.ipfire.org Git - thirdparty/linux.git/commit
perf cs-etm: Reject CPU IDs that would overflow signed comparison
authorArnaldo Carvalho de Melo <acme@redhat.com>
Thu, 11 Jun 2026 01:45:08 +0000 (22:45 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 17 Jun 2026 11:29:07 +0000 (08:29 -0300)
commit542e88a4c6f7b6edd1326ce767d4cb3c2ea9d61d
tree3faaee3280b033921d23b353abdb9e62317fe348
parent4a7500d772fe59653053db22ca83c9e2232b22e1
perf cs-etm: Reject CPU IDs that would overflow signed comparison

metadata[j][CS_ETM_CPU] is a u64 from perf.data, but the comparison
with max_cpu casts it to (int).  A crafted value like 0xFFFFFFFF becomes
-1 after the cast, which compares less than max_cpu (0), so the queue
array is never sized to accommodate it.  When the value is later passed
to cs_etm__get_queue(), it indexes queue_array with the original large
value, causing an out-of-bounds access.

Validate that CS_ETM_CPU fits in an int before using it in the signed
comparison.

Fixes: 57880a7966be510c ("perf: cs-etm: Allocate queues for all CPUs")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: James Clark <james.clark@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/cs-etm.c