Commit a881fc56 authored by Arnaldo Carvalho de Melo's avatar Arnaldo Carvalho de Melo Committed by Namhyung Kim
Browse files

perf header: Sanity check HEADER_MEM_TOPOLOGY 



Add validation to process_mem_topology() to harden against malformed
perf.data files:

- Upper bound check on nr_nodes (reuses MAX_NUMA_NODES, 4096)
- Minimum section size check before allocating

This is particularly important here since nr is u64, making unbounded
values especially dangerous.

Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude Code:claude-opus-4-6
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: default avatarNamhyung Kim <namhyung@kernel.org>
parent 4ba22301

tools/perf/util/header.c

+12 −0
Original line number Diff line number Diff line
@@ -3308,6 +3308,18 @@ static int process_mem_topology(struct feat_fd *ff, 
	if (do_read_u64(ff, &nr))

		return -1;



	if (nr > MAX_NUMA_NODES) {

		pr_err("Invalid HEADER_MEM_TOPOLOGY: nr_nodes (%llu) > %u\n",

		       (unsigned long long)nr, MAX_NUMA_NODES);

		return -1;

	}



	if (ff->size < 3 * sizeof(u64) + nr * 2 * sizeof(u64)) {

		pr_err("Invalid HEADER_MEM_TOPOLOGY: section too small (%zu) for %llu nodes\n",

		       ff->size, (unsigned long long)nr);

		return -1;

	}



	nodes = calloc(nr, sizeof(*nodes));

	if (!nodes)

		return -1;