[PATCH 4/6] perf/header: add bounds check for domain index in process_cpu_domain_info

[Wang Haoran]

>From 6558dce0d11d81872d73655bc8290cfb1dc499b2 Mon Sep 17 00:00:00 2001
From: Wang Haoran <haoranwangsec@xxxxxxxxx>
Date: Thu, 28 May 2026 15:17:21 +0800
Subject: [PATCH 4/6] perf/header: add bounds check for domain index in
 process_cpu_domain_info

process_cpu_domain_info() reads a domain index from the file and uses
it directly as an array index into cd_map[cpu]->domains[], which has
max_sched_domains entries.  A crafted file can supply a domain value
>= max_sched_domains, causing an out-of-bounds write.

Add a bounds check that rejects domain values outside the valid range.
Free the just-allocated d_info before returning to avoid a memory leak.

Fixes: <process_cpu_domain_info>
Signed-off-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
---
 tools/perf/util/header.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index f1a1831cf..6281e97ee 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -3670,6 +3670,11 @@ static int process_cpu_domain_info(struct feat_fd *ff, void *data __maybe_unused
 			if (!d_info)
 				return -1;
 
+			if (domain >= max_sched_domains) {
+				free(d_info);
+				return -1;
+			}
+
 			assert(cd_map[cpu]->domains[domain] == NULL);
 			cd_map[cpu]->domains[domain] = d_info;
 			d_info->domain = domain;
-- 
2.53.0



---
ASan output on perf 7.0.6 (unpatched) with the attached PoC:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==55941==ERROR: AddressSanitizer: SEGV on unknown address 0x729c3fbe0790 (pc 0x5e98934d9c97 bp 0x7ffd2f046790 sp 0x7ffd2f046650 T0)
==55941==The signal is caused by a WRITE memory access.
    #0 0x5e98934d9c97 in process_cpu_domain_info (perf+0x610c97) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #1 0x5e98934c6698 in perf_file_section__process (perf+0x5fd698) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #2 0x5e98934e5992 in perf_header__process_sections (perf+0x61c992) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #3 0x5e98934e7437 in perf_session__read_header (perf+0x61e437) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #4 0x5e9893521e67 in __perf_session__new (perf+0x658e67) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #5 0x5e989320dedd in cmd_sched (perf+0x344edd) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #6 0x5e989324c87f in handle_internal_command (perf+0x38387f) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #7 0x5e98930bf836 in main (perf+0x1f6836) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)
    #8 0x7669c0a2a600 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
    #9 0x7669c0a2a717 in __libc_start_main_impl ../csu/libc-start.c:360
    #10 0x5e98930c7754 in _start (perf+0x1fe754) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db)

==55941==Register values:
rax = 0x0000000050000000  rbx = 0x00007269be7f0a50  rcx = 0x00007289bfbe0970  rdx = 0x0000000000000020  
rdi = 0x0000729c3fbe0790  rsi = 0x00007299bfbe07c0  rbp = 0x00007ffd2f046790  rsp = 0x00007ffd2f046650  
 r8 = 0x00000e5137f7c137   r9 = 0x0000000000000000  r10 = 0x00000000000000dc  r11 = 0x00007669c24acfec  
r12 = 0x00007269be7f0aa0  r13 = 0x0000000000000000  r14 = 0x00007299bfbe07c0  r15 = 0x00007269be7f09b0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (perf+0x610c97) (BuildId: 25d667fa7a7274046cb5bcb3375c4b1074f3f6db) in process_cpu_domain_info
==55941==ABORTING

Attachment: crash_sig11_iter2.data
Description: Binary data