[PATCH 1/2] tools/power turbostat: Fix out-of-bounds memory access in thread_data allocation

[Zhang Rui <rui.zhang@intel.com>]

Turbostat suffers from a critical memory allocation bug that can cause
segmentation faults or silent data corruption.

This is because turbostat uses
1. num_cores * threads_per_core to allocate memory for per thread data
   (threads_per_core is calculated based on online CPU thread siblings,
   resulting in a value of 1 when SMT is inactive)
2. cpu_id to reference the thread data for a given cpu
And then, when SMT is inactive, it is possible that,
	num_cores * threads_per_core < cpu_id of certain online cpus
and this causes out-of-bounds memory access when referencing the thread
data for these CPUs.

For example,  on a 4-core system,
1. the core's are numbered 0,1,2,3
2. the CPU's are numbered 0,1,2,3 and the HT siblings are 4, 5,6,7,
When only CPU0 and CPU7 are online, turbostat allocates thread_data
memory for 4 threads (4 cores * 1 thread_per_core) but references
thread_data[7] for CPU7.

Fix the problem by using topo.max_cpu_num + 1 to represent the total
thread count instead. The topo.max_cpu_num value is derived from the
width of /sys/devices/system/cpu/cpuX/topology/thread_siblings, which
represents all possible CPUs regardless of their online/offline status.
This ensures adequate memory allocation for all potential CPU accesses.

Validated on multiple Intel platforms (ICX/SPR/SRF/EMR/GNR/CWF) with
various CPU online/offline configurations and SMT enabled/disabled
scenarios. No regression or memory access violation observed.

Fixes: a2b4d0f8bf07 ("tools/power turbostat: Favor cpu# over core#")
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
---
 tools/power/x86/turbostat/turbostat.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 1a2671c28209..ae827485950d 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -9702,13 +9702,12 @@ void allocate_counters(struct counters *counters)
 {
 	int i;
 	int num_cores = topo.cores_per_node * topo.nodes_per_pkg * topo.num_packages;
-	int num_threads = topo.threads_per_core * num_cores;
 
-	counters->threads = calloc(num_threads, sizeof(struct thread_data));
+	counters->threads = calloc(topo.max_cpu_num + 1, sizeof(struct thread_data));
 	if (counters->threads == NULL)
 		goto error;
 
-	for (i = 0; i < num_threads; i++)
+	for (i = 0; i < topo.max_cpu_num + 1; i++)
 		(counters->threads)[i].cpu_id = -1;
 
 	counters->cores = calloc(num_cores, sizeof(struct core_data));
-- 
2.43.0