Re: [PATCH 05/13] perf header: Sanity check HEADER_NUMA_TOPOLOGY

sashiko-bot
2026-04-10T01:04:29Z

Sashiko AI review found 1 potential issue(s):
- [Low] The minimum section size calculation under-calculates the required bytes per node by omitting the string length field.
--

commit 39d7a2e6e6f3028c87af277c0da0635894776c8f
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf header: Sanity check HEADER_NUMA_TOPOLOGY

This commit adds validation to process_numa_topology to harden against
malformed perf.data files. It adds an upper bound check on nr_nodes and
verifies the minimum section size before allocating the nodes array.

> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c
[ ... ]
> @@ -3003,6 +3003,19 @@ static int process_numa_topology(struct feat_fd *ff, void *data __maybe_unused)
[ ... ]
> + if (ff->size < sizeof(u32) + nr * (sizeof(u32) + 2 * sizeof(u64))) {

Does this minimum section size calculation under-count the required bytes
per node?

The validation check calculates the minimum payload size as 20 bytes per
node for the node, mem_total, and mem_free fields. However, the subsequent
loop also reads a string for each node via do_read_string().

Since do_read_string() internally reads a mandatory 4-byte string length
field first, does the actual minimum size per node need to account for
those additional 4 bytes?

> + pr_err("Invalid HEADER_NUMA_TOPOLOGY: section too small (%zu) for %u nodes\n",
> + ff->size, nr);
> + return -1;
> + }
> +
> nodes = calloc(nr, sizeof(*nodes));

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260410004000.148138-1-acme@kernel.org?part=5