Re: [PATCH v10 26/29] perf timechart: Bounds check CPU

sashiko-bot
2026-04-12T02:50:58Z

Sashiko AI review found 1 potential issue(s):
- [High] The bounds check for CPU IDs fails to protect the dynamically allocated `topology_map` array, allowing out-of-bounds heap reads during SVG rendering.
--

commit 6083479d6ab93bb66bdea31d29ed3a4768c300e7
Author: Ian Rogers <irogers@google.com>

perf timechart: Bounds check CPU

This commit ensures the CPU ID is within expected bounds when processing
samples. It aims to prevent out-of-bounds memory accesses in arrays
tracking CPU state by bounding the CPU ID to MAX_CPUS.

> diff --git a/tools/perf/builtin-timechart.c b/tools/perf/builtin-timechart.c
> index 64f69bd67c6b7..64903b54e8a73 100644
> --- a/tools/perf/builtin-timechart.c
> +++ b/tools/perf/builtin-timechart.c
[ ... ]
> @@ -1517,6 +1544,8 @@ static int process_header(struct perf_file_section *section __maybe_unused,
> switch (feat) {
> case HEADER_NRCPUS:
> tchart->numcpus = ph->env.nr_cpus_avail;
> + if (tchart->numcpus > MAX_CPUS)
> + tchart->numcpus = MAX_CPUS;

Does this bounds check fully protect the dynamically allocated topology_map
array?

While this limits tchart->numcpus to MAX_CPUS, topology_map is dynamically
allocated in svg_build_topology_map() with a size based on
env->nr_cpus_online.

Because nr_cpus_avail can be larger than nr_cpus_online on systems with
offline CPUs, and trace events can have CPU IDs up to MAX_CPUS - 1, could
CPU indices exceed the bounds of topology_map?

When perf timechart --topology is used, cpu2y() indexes into
topology_map[cpu], which might still result in an out-of-bounds heap read
during SVG rendering.

> break;
>
> case HEADER_CPU_TOPOLOGY:

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260412020833.641177-1-irogers@google.com?part=26