From a881fc56038a7baa5cb5074cdd52315d9ad9ee63 Mon Sep 17 00:00:00 2001 From: Arnaldo Carvalho de Melo Date: Fri, 10 Apr 2026 19:08:58 -0300 Subject: [PATCH] perf header: Sanity check HEADER_MEM_TOPOLOGY Add validation to process_mem_topology() to harden against malformed perf.data files: - Upper bound check on nr_nodes (reuses MAX_NUMA_NODES, 4096) - Minimum section size check before allocating This is particularly important here since nr is u64, making unbounded values especially dangerous. Cc: Jiri Olsa Cc: Ian Rogers Assisted-by: Claude Code:claude-opus-4-6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim --- tools/perf/util/header.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 2f405776e501..2eb909672f82 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -3308,6 +3308,18 @@ static int process_mem_topology(struct feat_fd *ff, if (do_read_u64(ff, &nr)) return -1; + if (nr > MAX_NUMA_NODES) { + pr_err("Invalid HEADER_MEM_TOPOLOGY: nr_nodes (%llu) > %u\n", + (unsigned long long)nr, MAX_NUMA_NODES); + return -1; + } + + if (ff->size < 3 * sizeof(u64) + nr * 2 * sizeof(u64)) { + pr_err("Invalid HEADER_MEM_TOPOLOGY: section too small (%zu) for %llu nodes\n", + ff->size, (unsigned long long)nr); + return -1; + } + nodes = calloc(nr, sizeof(*nodes)); if (!nodes) return -1;