Re: [PATCH 05/13] perf header: Sanity check HEADER_NUMA_TOPOLOGY

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Low] The minimum section size calculation for HEADER_NUMA_TOPOLOGY omits the mandatory string length field per node.
--

commit 5064a9beb88eb8009f39a18c54d4d42f61a38a69
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf header: Sanity check HEADER_NUMA_TOPOLOGY

This commit adds validation to process_numa_topology() to harden against
malformed perf.data files. It introduces an upper bound check on nr_nodes
and a minimum section size check before allocating memory.

> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index acd6b07528e01..2f405776e5013 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c

[ ... ]

> @@ -3005,6 +3006,18 @@ static int process_numa_topology(struct feat_fd *ff, void *data __maybe_unused)
>  	if (do_read_u32(ff, &nr))
>  		return -1;
>  
> +	if (nr > MAX_NUMA_NODES) {
> +		pr_err("Invalid HEADER_NUMA_TOPOLOGY: nr_nodes (%u) > %u\n",
> +		       nr, MAX_NUMA_NODES);
> +		return -1;
> +	}
> +
> +	if (ff->size < sizeof(u32) + nr * (sizeof(u32) + 2 * sizeof(u64))) {

Does this calculation omit the mandatory string length field for each node?

The subsequent parsing loop reads the node ID, memory totals, and a CPU map
string:

        if (do_read_u32(ff, &n->node))
                goto error;
        if (do_read_u64(ff, &n->mem_total))
                goto error;
        if (do_read_u64(ff, &n->mem_free))
                goto error;
        str = do_read_string(ff);

Since do_read_string() always reads a u32 length prefix before the string
content, the true minimum size per node appears to be 24 bytes rather than 20
bytes (sizeof(u32) + 2 * sizeof(u64) + sizeof(u32)).

While truncated files will still safely fail later during the actual read
operations, this calculation allows slightly truncated files to bypass the
new validation check.

> +		pr_err("Invalid HEADER_NUMA_TOPOLOGY: section too small (%zu) for %u nodes\n",
> +		       ff->size, nr);
> +		return -1;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260410220905.200051-1-acme@kernel.org?part=5