perf sched: Cap max_cpu at MAX_CPUS in timehist sample processing

perf_timehist__process_sample() updates sched->max_cpu from the
sample CPU without bounds checking.  Later code uses max_cpu + 1 as
an iteration count over arrays allocated with MAX_CPUS entries
(curr_thread, cpu_last_switched).  A recording with CPU IDs >= MAX_CPUS
causes out-of-bounds array accesses.

Also cap the env->nr_cpus_online initialization of max_cpu in
perf_sched__timehist(), which could exceed MAX_CPUS on very large
systems.

Add bounds checks before both max_cpu updates, matching the pattern
already used in map_switch_event().

Fixes: 49394a2a24c7 ("perf sched timehist: Introduce timehist command")
Reviewed-by: David Ahern <dsahern@kernel.org>
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 7bd61028327b39db945b2be56b4588888f4262ca..87a1f4cf8760e1e934962a3d3bfaead4cf24995b 100644 (file)
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -3215,7 +3215,9 @@ static int perf_timehist__process_sample(const struct perf_tool *tool,
                .cpu = sample->cpu,
        };
 
-       if (this_cpu.cpu > sched->max_cpu.cpu)
+       /* max_cpu indexes arrays allocated with MAX_CPUS entries */
+       if (this_cpu.cpu >= 0 && this_cpu.cpu < MAX_CPUS &&
+           this_cpu.cpu > sched->max_cpu.cpu)
                sched->max_cpu = this_cpu;
 
        if (evsel->handler != NULL) {
@@ -3385,8 +3387,8 @@ static int perf_sched__timehist(struct perf_sched *sched)
                perf_session__set_tracepoints_handlers(session, migrate_handlers))
                goto out;
 
-       /* pre-allocate struct for per-CPU idle stats */
-       sched->max_cpu.cpu = env->nr_cpus_online;
+       /* pre-allocate struct for per-CPU idle stats; cap to array bounds */
+       sched->max_cpu.cpu = min(env->nr_cpus_online, MAX_CPUS);
        if (sched->max_cpu.cpu == 0)
                sched->max_cpu.cpu = 4;
        if (init_idle_threads(sched->max_cpu.cpu))