From: Arnaldo Carvalho de Melo Date: Thu, 4 Jun 2026 21:14:23 +0000 (-0300) Subject: perf tools: Add bounds check to cpu__get_node() X-Git-Tag: v7.2-rc1~60^2~116 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=1e7921d7227de5da0dfc167943092c823ec7e49b;p=thirdparty%2Fkernel%2Flinux.git perf tools: Add bounds check to cpu__get_node() cpu__get_node() accesses cpunode_map[cpu.cpu] without checking against max_cpu_num, the allocation size of cpunode_map. Callers such as builtin-kmem.c:evsel__process_alloc_event() pass sample->cpu from perf.data events, which may exceed the host's CPU count when analyzing cross-machine recordings. Add a bounds check against max_cpu_num before indexing, returning -1 for out-of-range values. This is a central fix that protects all callers. Fixes: 86895b480a2f ("perf stat: Add --per-node agregation support") Reported-by: sashiko-bot Cc: Jiri Olsa Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo --- diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c index b1e5c29c6e3ec..d3432622b2adc 100644 --- a/tools/perf/util/cpumap.c +++ b/tools/perf/util/cpumap.c @@ -576,6 +576,10 @@ int cpu__get_node(struct perf_cpu cpu) return -1; } + /* cpunode_map allocated for max_cpu_num entries; input may be untrusted */ + if (cpu.cpu < 0 || cpu.cpu >= max_cpu_num.cpu) + return -1; + return cpunode_map[cpu.cpu]; }