[PATCH v1 2/7] perf evsel: Add bounds check for PERF_RECORD_CALLCHAIN_DEFERRED ips array
From: Ian Rogers
Date: Sun Oct 25 2026 - 18:05:02 EST
In __evsel__parse_sample(), verify that event->callchain_deferred.nr and
the trailing ips[] array fit within event->header.size using
OVERFLOW_CHECK_u64() and OVERFLOW_CHECK() before exposing data->callchain
to callers.
Fixes: da27c4379ce6 ("perf session: Add minimum event size and alignment validation")
Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
---
tools/perf/util/evsel.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index d060fca8090f..64f090ebaa5a 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -3474,9 +3474,12 @@ int __evsel__parse_sample(struct evsel *evsel, union perf_event *event,
if (event->header.type == PERF_RECORD_CALLCHAIN_DEFERRED) {
const u64 max_callchain_nr = UINT64_MAX / sizeof(u64);
+ OVERFLOW_CHECK_u64(&event->callchain_deferred.nr);
data->callchain = (struct ip_callchain *)&event->callchain_deferred.nr;
if (data->callchain->nr > max_callchain_nr)
goto out_efault;
+ OVERFLOW_CHECK(event->callchain_deferred.ips,
+ data->callchain->nr * sizeof(u64), max_size);
data->deferred_cookie = event->callchain_deferred.cookie;
--
2.56.0.307.g5fe7bd680c-goog