[PATCH] perf powerpc-vpadtl: Validate dispatch/preempt reason indices before array access
Wang Yan <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel,org.kernel.vger.linux-perf-users,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
powerpc_vpadtl_dump() indexes the dispatch_reasons[11] and
preempt_reasons[10] string arrays using the u8 fields
dtl->dispatch_reason and dtl->preempt_reason taken directly from the
untrusted auxtrace payload. A crafted perf.data file can set either
field to a value that exceeds the array bounds, causing an
out-of-bounds read of a const char * pointer that is then passed to
printf("%s").
Bound the indices with ARRAY_SIZE() and fall back to "unknown" when
they are out of range, following the same defensive pattern used in
amd-sample-raw.c for data_src_str[].
Fixes: c4bbd4ec2e50 ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Cc: [email protected]
Signed-off-by: Wang Yan <[email protected]>
---
tools/perf/util/powerpc-vpadtl.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
index 710f3093f3f9..6be04fbcd6b7 100644
--- a/tools/perf/util/powerpc-vpadtl.c
+++ b/tools/perf/util/powerpc-vpadtl.c
@@ -113,8 +113,10 @@ static void powerpc_vpadtl_dump(struct powerpc_vpadtl *vpa __maybe_unused,
printf("dispatch_reason:%s, preempt_reason:%s, "
"enqueue_to_dispatch_time:%d, ready_to_enqueue_time:%d, "
"waiting_to_ready_time:%d\n",
- dispatch_reasons[dtl->dispatch_reason],
- preempt_reasons[dtl->preempt_reason],
+ dtl->dispatch_reason < ARRAY_SIZE(dispatch_reasons)
+ ? dispatch_reasons[dtl->dispatch_reason] : "unknown",
+ dtl->preempt_reason < ARRAY_SIZE(preempt_reasons)
+ ? preempt_reasons[dtl->preempt_reason] : "unknown",
be32_to_cpu(dtl->enqueue_to_dispatch_time),
be32_to_cpu(dtl->ready_to_enqueue_time),
be32_to_cpu(dtl->waiting_to_ready_time));
--
2.25.1