diff options
| author | David Ahern <david.ahern@oracle.com> | 2015-06-15 16:15:45 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-06-25 06:01:02 -0700 |
| commit | b69fb7699c92f85991672fc144b0adb7c717fbc8 (patch) | |
| tree | 07291dc96b98d4037d8466e12d5dc3b9207f52c0 /arch/sparc/kernel | |
| parent | 2bf7c3efc393937d1e5f92681501a914dbfbae07 (diff) | |
| download | linux-b69fb7699c92f85991672fc144b0adb7c717fbc8.tar.bz2 | |
sparc64: perf: Add sanity checking on addresses in user stack
Processes are getting killed (sigbus or segv) while walking userspace
callchains when using perf. In some instances I have seen ufp = 0x7ff
which does not seem like a proper stack address.
This patch adds a function to run validity checks against the address
before attempting the copy_from_user. The checks are copied from the
x86 version as a start point with the addition of a 4-byte alignment
check.
Signed-off-by: David Ahern <david.ahern@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch/sparc/kernel')
| -rw-r--r-- | arch/sparc/kernel/perf_event.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c index 48387be665e9..a665e3f8c6c6 100644 --- a/arch/sparc/kernel/perf_event.c +++ b/arch/sparc/kernel/perf_event.c @@ -1741,6 +1741,16 @@ void perf_callchain_kernel(struct perf_callchain_entry *entry, } while (entry->nr < PERF_MAX_STACK_DEPTH); } +static inline int +valid_user_frame(const void __user *fp, unsigned long size) +{ + /* addresses should be at least 4-byte aligned */ + if (((unsigned long) fp) & 3) + return 0; + + return (__range_not_ok(fp, size, TASK_SIZE) == 0); +} + static void perf_callchain_user_64(struct perf_callchain_entry *entry, struct pt_regs *regs) { @@ -1753,6 +1763,9 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, unsigned long pc; usf = (struct sparc_stackf __user *)ufp; + if (!valid_user_frame(usf, sizeof(sf))) + break; + if (__copy_from_user_inatomic(&sf, usf, sizeof(sf))) break; |