]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf timechart: Fix cpu2y() OOB read on untrusted CPU index
authorArnaldo Carvalho de Melo <acme@redhat.com>
Sat, 6 Jun 2026 14:21:32 +0000 (11:21 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Sat, 6 Jun 2026 17:27:52 +0000 (14:27 -0300)
commite2496db45bfd8dfb6154ec415798fee330f1cc0a
tree2eb681f5554027a2d8fb959aeb2237052b0c3f3a
parent5e5e6196d737c5be03d20647428316b36621608d
perf timechart: Fix cpu2y() OOB read on untrusted CPU index

cpu2y() indexes topology_map[cpu] without bounds checking.  The array
is allocated with nr_cpus entries (from env->nr_cpus_online), but
callers pass sample CPU values from perf.data which can exceed that
size with cross-machine recordings.

Track the topology_map allocation size and bounds-check the CPU
argument in cpu2y() before indexing.  Out-of-bounds CPUs fall back
to the identity mapping (cpu2slot(cpu)), which is the same behavior
as when no topology is available.

Fixes: c507999790438cde ("perf timechart: Add support for topology")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Stanislav Fomichev <stfomichev@yandex-team.ru>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/svghelper.c