]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf mmap: Guard cpu__get_node() return in aio_bind()
authorArnaldo Carvalho de Melo <acme@redhat.com>
Fri, 5 Jun 2026 13:56:33 +0000 (10:56 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Fri, 5 Jun 2026 20:22:21 +0000 (17:22 -0300)
commitf32dc302a090f48893477ef297a888db109ec0bd
tree038c9b41bf9854ae847e8937a05bb8bd0105725e
parent5949d339f5ec98752d56dcd4e36f619a59d513a5
perf mmap: Guard cpu__get_node() return in aio_bind()

perf_mmap__aio_bind() passes the cpu__get_node() return value directly
to an unsigned long variable (node_index).  When cpu__get_node() returns
-1 for an unknown CPU, the implicit int-to-unsigned-long conversion
sign-extends it to ULONG_MAX.

This causes bitmap_zalloc(ULONG_MAX + 1) which wraps to
bitmap_zalloc(0), returning a zero-sized allocation.  The subsequent
__set_bit(ULONG_MAX, node_mask) then writes massively out of bounds.

Check the return value in a signed temporary before assigning to
node_index, and skip the NUMA binding when the node is unknown.

Fixes: c44a8b44ca9f ("perf record: Bind the AIO user space buffers to nodes")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/mmap.c