Re: [PATCH 04/13] perf header: Sanity check HEADER_CPU_TOPOLOGY

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] The patch introduces a deterministic NULL pointer dereference crash on malformed inputs by incorrectly freeing `env->cpu`. The author changed `return -1;` to `goto free_cpu;` (which calls `zfree(&env->cpu)`) under the mistaken assumption that `env->cpu` was leaking.
--

commit 725d6d7d1ccd2df010084b584d9517330e1864ac
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf header: Sanity check HEADER_CPU_TOPOLOGY

This commit adds bounds checking for sibling counts against available
CPUs in the CPU topology header and attempts to prevent a perceived
leak of the env->cpu array on error paths.

> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index 2d23dbc666b67..a7df8ed9a69e9 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c

[ ... ]

> @@ -2866,6 +2871,12 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
>  	if (do_read_u32(ff, &nr))
>  		goto free_cpu;
>  
> +	if (nr > (u32)cpu_nr) {
> +		pr_err("Invalid HEADER_CPU_TOPOLOGY: nr_sibling_cores (%u) > nr_cpus_avail (%d)\n",
> +		       nr, cpu_nr);
> +		goto free_cpu;
> +	}
> +

[ ... ]

>  error:
>  	strbuf_release(&sb);
>  	zfree(&str);
>  free_cpu:
>  	zfree(&env->cpu);
>  	return -1;
>  }

Does this zfree() cause a NULL pointer dereference regression on malformed
inputs?

When a parsing error occurs, env->cpu is freed and set to NULL. However,
perf_session__read_header() ignores the error returned by
perf_header__process_sections() and proceeds with the session.

If the session continues, tools like perf stat will later call functions
such as perf_env__get_socket_aggr_by_cpu(), which unconditionally
dereferences env->cpu[cpu.cpu].socket_id.

Was env->cpu actually leaking before this change? It appears to be safely
cleaned up during teardown by perf_env__exit() even if an error is
encountered here.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260410004000.148138-1-acme@kernel.org?part=4