Commit f613a6d6 authored by Arnaldo Carvalho de Melo's avatar Arnaldo Carvalho de Melo Committed by Namhyung Kim
Browse files

perf header: Sanity check HEADER_PMU_MAPPINGS 



Add upper bound check on pmu_num in process_pmu_mappings() to harden
against malformed perf.data files (max 4096).

Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude Code:claude-opus-4-6
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: default avatarNamhyung Kim <namhyung@kernel.org>
parent a881fc56

tools/perf/util/header.c

+13 −0
Original line number Diff line number Diff line
@@ -64,6 +64,7 @@ 
#endif



#define MAX_NUMA_NODES		4096

#define MAX_PMU_MAPPINGS	4096

#define MAX_SCHED_DOMAINS	64



/*
@@ -3069,6 +3070,18 @@ static int process_pmu_mappings(struct feat_fd *ff, void *data __maybe_unused) 
		return 0;

	}



	if (pmu_num > MAX_PMU_MAPPINGS) {

		pr_err("Invalid HEADER_PMU_MAPPINGS: pmu_num (%u) > %u\n",

		       pmu_num, MAX_PMU_MAPPINGS);

		return -1;

	}



	if (ff->size < sizeof(u32) + pmu_num * 2 * sizeof(u32)) {

		pr_err("Invalid HEADER_PMU_MAPPINGS: section too small (%zu) for %u PMUs\n",

		       ff->size, pmu_num);

		return -1;

	}



	env->nr_pmu_mappings = pmu_num;

	if (strbuf_init(&sb, 128) < 0)

		return -1;