perf timechart: Fix cpu2y() OOB read on untrusted CPU index

cpu2y() indexes topology_map[cpu] without bounds checking.  The array
is allocated with nr_cpus entries (from env->nr_cpus_online), but
callers pass sample CPU values from perf.data which can exceed that
size with cross-machine recordings.

Track the topology_map allocation size and bounds-check the CPU
argument in cpu2y() before indexing.  Out-of-bounds CPUs fall back
to the identity mapping (cpu2slot(cpu)), which is the same behavior
as when no topology is available.

Fixes: c507999790438cde ("perf timechart: Add support for topology")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Stanislav Fomichev <stfomichev@yandex-team.ru>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

diff --git a/tools/perf/util/svghelper.c b/tools/perf/util/svghelper.c
index e360e7736c7ba65b6a02ebba4117e11d5639e374..826bd2577344b20f0fc0e285088211578e09f653 100644 (file)
--- a/tools/perf/util/svghelper.c
+++ b/tools/perf/util/svghelper.c
@@ -47,13 +47,13 @@ static double cpu2slot(int cpu)
 }
 
 static int *topology_map;
+static int topology_map_size;
 
 static double cpu2y(int cpu)
 {
-       if (topology_map)
+       if (topology_map && cpu >= 0 && cpu < topology_map_size)
                return cpu2slot(topology_map[cpu]) * SLOT_MULT;
-       else
-               return cpu2slot(cpu) * SLOT_MULT;
+       return cpu2slot(cpu) * SLOT_MULT;
 }
 
 static double time2pixels(u64 __time)
@@ -736,7 +736,8 @@ static int str_to_bitmap(char *s, cpumask_t *b, int nr_cpus)
                return -1;
 
        perf_cpu_map__for_each_cpu(cpu, idx, map) {
-               if (cpu.cpu >= nr_cpus) {
+               /* perf_cpu_map__new("") returns cpu.cpu == -1 */
+               if (cpu.cpu < 0 || cpu.cpu >= nr_cpus) {
                        ret = -1;
                        break;
                }
@@ -794,6 +795,7 @@ int svg_build_topology_map(struct perf_env *env)
                fprintf(stderr, "topology: no memory\n");
                goto exit;
        }
+       topology_map_size = nr_cpus;
 
        for (i = 0; i < nr_cpus; i++)
                topology_map[i] = -1;