]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
authorArnaldo Carvalho de Melo <acme@redhat.com>
Sat, 6 Jun 2026 23:57:49 +0000 (20:57 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 10 Jun 2026 14:38:45 +0000 (11:38 -0300)
commit5484b43a0ec8231c36fba6ead654cb72dbba8b8f
tree89e8b1f66f0a22f688123541afaee9199b4a939b
parent7953a3a9b8e02e98c6e6958f291d0ae22393e46a
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail.  Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.

Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.

Fixes: 0c4c4debb0adda4c ("perf tools: Add processor socket info to hist_entry and addr_location")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/event.c