diff options
| author | Arnaldo Carvalho de Melo <acme@redhat.com> | 2026-04-11 01:08:59 +0300 |
|---|---|---|
| committer | Namhyung Kim <namhyung@kernel.org> | 2026-04-14 09:21:53 +0300 |
| commit | f613a6d694aa499edb2a291ab2c2d906619585f2 (patch) | |
| tree | 04071765e4f0fc05d313202fe85514a9103cd7d8 | |
| parent | a881fc56038a7baa5cb5074cdd52315d9ad9ee63 (diff) | |
| download | linux-f613a6d694aa499edb2a291ab2c2d906619585f2.tar.xz | |
perf header: Sanity check HEADER_PMU_MAPPINGS
Add upper bound check on pmu_num in process_pmu_mappings() to harden
against malformed perf.data files (max 4096).
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude Code:claude-opus-4-6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
| -rw-r--r-- | tools/perf/util/header.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c index 2eb909672f82..77035d9b138c 100644 --- a/tools/perf/util/header.c +++ b/tools/perf/util/header.c @@ -64,6 +64,7 @@ #endif #define MAX_NUMA_NODES 4096 +#define MAX_PMU_MAPPINGS 4096 #define MAX_SCHED_DOMAINS 64 /* @@ -3069,6 +3070,18 @@ static int process_pmu_mappings(struct feat_fd *ff, void *data __maybe_unused) return 0; } + if (pmu_num > MAX_PMU_MAPPINGS) { + pr_err("Invalid HEADER_PMU_MAPPINGS: pmu_num (%u) > %u\n", + pmu_num, MAX_PMU_MAPPINGS); + return -1; + } + + if (ff->size < sizeof(u32) + pmu_num * 2 * sizeof(u32)) { + pr_err("Invalid HEADER_PMU_MAPPINGS: section too small (%zu) for %u PMUs\n", + ff->size, pmu_num); + return -1; + } + env->nr_pmu_mappings = pmu_num; if (strbuf_init(&sb, 128) < 0) return -1; |