diff options
| author | Nicholas Piggin <npiggin@gmail.com> | 2022-11-27 22:49:28 +1000 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2022-12-02 17:54:07 +1100 |
| commit | 32c5209214bd8d4f8c4e9d9b630ef4c671f58e79 (patch) | |
| tree | f5d5018c08cff0072a51914eee1e97e798988532 /COPYING | |
| parent | d6aee468e4ecbfec46a3eafae4d31d6efc0d4da4 (diff) | |
| download | linux-32c5209214bd8d4f8c4e9d9b630ef4c671f58e79.tar.bz2 | |
powerpc/perf: callchain validate kernel stack pointer bounds
The interrupt frame detection and loads from the hypothetical pt_regs
are not bounds-checked. The next-frame validation only bounds-checks
STACK_FRAME_OVERHEAD, which does not include the pt_regs. Add another
test for this.
The user could set r1 to be equal to the address matching the first
interrupt frame - STACK_INT_FRAME_SIZE, which is in the previous page
due to the kernel redzone, and induce the kernel to load the marker from
there. Possibly this could cause a crash at least. If the user could
induce the previous page to contain a valid marker, then it might be
able to direct perf to read specific memory addresses in a way that
could be transmitted back to the user in the perf data.
Fixes: 20002ded4d93 ("perf_counter: powerpc: Add callchain support")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20221127124942.1665522-4-npiggin@gmail.com
Diffstat (limited to 'COPYING')
0 files changed, 0 insertions, 0 deletions