Re: [PATCH 22/29] perf header: Validate bitmap size before allocating in do_read_bitmap()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The comment describing the per-node data layout does not accurately reflect the actual fields parsed by the code.
--

commit d907ff7c8f16b6254548f1529a40af97b741421f
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf header: Validate bitmap size before allocating in do_read_bitmap()

This commit adds bounds checking and size validation to do_read_bitmap()
to prevent out-of-bounds allocations and reads. It also changes the
allocation to u64 units to avoid truncation on 32-bit architectures, and
fixes related memory leaks and bounds checks in process_mem_topology().

Closes: https://lore.kernel.org/linux-perf-users/20260414224622.2AE69C19425@smtp.kernel.org/
Closes: https://lore.kernel.org/linux-perf-users/20260410223242.DD76FC19421@smtp.kernel.org/

> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index 37d7c9849e0e9..66929c5557b21 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c

[ ... ]

> @@ -3497,7 +3520,8 @@ static int process_mem_topology(struct feat_fd *ff,
>  		return -1;
>  	}
>  
> -	if (ff->size < 3 * sizeof(u64) + nr * 2 * sizeof(u64)) {
> +	/* Per node: version(u64) + bitmap_size(u64) + bitmap data (>= 1 u64) */

[Severity: Low]
This isn't a bug, but does this comment accurately reflect the actual fields
parsed by the code?

It appears the first per-node field is actually the node ID, not the version,
and this comment omits one of the two size fields written per node. It also
assumes the bitmap data is always >= 1 u64 (when it could be 0). While the
calculation nr * 3 * sizeof(u64) correctly accounts for the 3 metadata u64
fields (node ID, size, and the second size from do_read_bitmap()), the text
describing the layout seems slightly incorrect.

> +	if (ff->size < 3 * sizeof(u64) + nr * 3 * sizeof(u64)) {
>  		pr_err("Invalid HEADER_MEM_TOPOLOGY: section too small (%zu) for %llu nodes\n",
>  		       ff->size, (unsigned long long)nr);
>  		return -1;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525010550.1100375-1-acme@kernel.org?part=22