[PATCH] perf powerpc-vpadtl: Validate dispatch/preempt reason indices before array access

[PATCH] perf powerpc-vpadtl: Validate dispatch/preempt reason indices before array access

[Wang Yan]

powerpc_vpadtl_dump() indexes the dispatch_reasons[11] and
preempt_reasons[10] string arrays using the u8 fields
dtl->dispatch_reason and dtl->preempt_reason taken directly from the
untrusted auxtrace payload.  A crafted perf.data file can set either
field to a value that exceeds the array bounds, causing an
out-of-bounds read of a const char * pointer that is then passed to
printf("%s").

Bound the indices with ARRAY_SIZE() and fall back to "unknown" when
they are out of range, following the same defensive pattern used in
amd-sample-raw.c for data_src_str[].

Fixes: c4bbd4ec2e50 ("perf powerpc: Process auxtrace events and display in 'perf report -D'")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
---
 tools/perf/util/powerpc-vpadtl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/perf/util/powerpc-vpadtl.c b/tools/perf/util/powerpc-vpadtl.c
index 710f3093f3f9..6be04fbcd6b7 100644
--- a/tools/perf/util/powerpc-vpadtl.c
+++ b/tools/perf/util/powerpc-vpadtl.c
@@ -113,8 +113,10 @@ static void powerpc_vpadtl_dump(struct powerpc_vpadtl *vpa __maybe_unused,
 			printf("dispatch_reason:%s, preempt_reason:%s, "
 					"enqueue_to_dispatch_time:%d, ready_to_enqueue_time:%d, "
 					"waiting_to_ready_time:%d\n",
-					dispatch_reasons[dtl->dispatch_reason],
-					preempt_reasons[dtl->preempt_reason],
+					dtl->dispatch_reason < ARRAY_SIZE(dispatch_reasons)
+						? dispatch_reasons[dtl->dispatch_reason] : "unknown",
+					dtl->preempt_reason < ARRAY_SIZE(preempt_reasons)
+						? preempt_reasons[dtl->preempt_reason] : "unknown",
 					be32_to_cpu(dtl->enqueue_to_dispatch_time),
 					be32_to_cpu(dtl->ready_to_enqueue_time),
 					be32_to_cpu(dtl->waiting_to_ready_time));
-- 
2.25.1