perf c2c: Bounds-check CPU and node IDs before bitmap and array access

c2c_he__set_cpu() passes sample->cpu directly to __set_bit(cpu, cpuset)
after only checking for the (u32)-1 sentinel.  The cpuset bitmap is
allocated with c2c.cpus_cnt bits (from env->nr_cpus_avail), so a crafted
perf.data with CPU IDs exceeding that count causes out-of-bounds heap
writes.

c2c_he__set_node() similarly passes the node ID from mem2node__node()
to __set_bit(node, nodeset) after only checking for negative values.
The nodeset bitmap is sized to c2c.nodes_cnt (from env->nr_numa_nodes),
so a node ID exceeding that causes OOB writes.

process_sample_event() indexes c2c.cpu2node[cpu] and
c2c_he->node_stats[node] without bounds checking.  Both arrays are
sized to c2c.cpus_cnt and c2c.nodes_cnt respectively.

Add bounds checks in all three paths:
  - c2c_he__set_cpu(): return if sample->cpu >= c2c.cpus_cnt
  - c2c_he__set_node(): return if node >= c2c.nodes_cnt
  - process_sample_event(): clamp cpu to 0 if >= cpus_cnt,
    guard node_stats access with bounds check

Fixes: 1e181b92a2da ("perf c2c report: Add 'node' sort key")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index 3dd45a550fdb772acafdce57e205b6a9359b09b4..f060dfbe11c285bfc6d7a897075204049e77f160 100644 (file)
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -245,6 +245,10 @@ static void c2c_he__set_cpu(struct c2c_hist_entry *c2c_he,
                      "WARNING: no sample cpu value"))
                return;
 
+       /* cpuset bitmap has c2c.cpus_cnt bits from env->nr_cpus_avail */
+       if (sample->cpu >= (unsigned int)c2c.cpus_cnt)
+               return;
+
        __set_bit(sample->cpu, c2c_he->cpuset);
 }
 
@@ -262,6 +266,10 @@ static void c2c_he__set_node(struct c2c_hist_entry *c2c_he,
        if (WARN_ONCE(node < 0, "WARNING: failed to find node\n"))
                return;
 
+       /* nodeset bitmap has c2c.nodes_cnt bits from env->nr_numa_nodes */
+       if (node >= c2c.nodes_cnt)
+               return;
+
        __set_bit(node, c2c_he->nodeset);
 
        if (c2c_he->paddr != sample->phys_addr) {
@@ -391,7 +399,12 @@ static int process_sample_event(const struct perf_tool *tool __maybe_unused,
                 * Doing node stats only for single callchain data.
                 */
                int cpu = sample->cpu == (unsigned int) -1 ? 0 : sample->cpu;
-               int node = c2c.cpu2node[cpu];
+               int node;
+
+               /* cpu2node[] has c2c.cpus_cnt entries; large u32 wraps signed negative */
+               if (cpu < 0 || cpu >= c2c.cpus_cnt)
+                       cpu = 0;
+               node = c2c.cpu2node[cpu];
 
                c2c_hists = he__get_c2c_hists(he, c2c.cl_sort, 2, machine->env);
                if (!c2c_hists) {
@@ -410,7 +423,9 @@ static int process_sample_event(const struct perf_tool *tool __maybe_unused,
                c2c_he = container_of(he, struct c2c_hist_entry, he);
                c2c_add_stats(&c2c_he->stats, &stats);
                c2c_add_stats(&c2c_hists->stats, &stats);
-               c2c_add_stats(&c2c_he->node_stats[node], &stats);
+               /* node_stats[] has c2c.nodes_cnt entries */
+               if (node >= 0 && node < c2c.nodes_cnt)
+                       c2c_add_stats(&c2c_he->node_stats[node], &stats);
 
                compute_stats(c2c_he, &stats, sample->weight);