| Message ID | 20190511024217.4013-1-ravi.bangoria@linux.ibm.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [1/2] perf ioctl: Add check for the sample_period value | expand |
| Context | Check | Description |
|---|---|---|
| snowpatch_ozlabs/apply_patch | success | Successfully applied on branch next (8150a153c013aa2dd1ffae43370b89ac1347a7fb) |
| snowpatch_ozlabs/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 9 lines checked |
On Sat, May 11, 2019 at 08:12:16AM +0530, Ravi Bangoria wrote: > Add a check for sample_period value sent from userspace. Negative > value does not make sense. And in powerpc arch code this could cause > a recursive PMI leading to a hang (reported when running perf-fuzzer). > > Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com> > --- > kernel/events/core.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/kernel/events/core.c b/kernel/events/core.c > index abbd4b3b96c2..e44c90378940 100644 > --- a/kernel/events/core.c > +++ b/kernel/events/core.c > @@ -5005,6 +5005,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) > if (perf_event_check_period(event, value)) > return -EINVAL; > > + if (!event->attr.freq && (value & (1ULL << 63))) > + return -EINVAL; Well, perf_event_attr::sample_period is __u64. Would not be the site using it as signed be the one in error?
On Mon, May 13, 2019 at 09:42:13AM +0200, Peter Zijlstra wrote: > On Sat, May 11, 2019 at 08:12:16AM +0530, Ravi Bangoria wrote: > > Add a check for sample_period value sent from userspace. Negative > > value does not make sense. And in powerpc arch code this could cause > > a recursive PMI leading to a hang (reported when running perf-fuzzer). > > > > Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com> > > --- > > kernel/events/core.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/kernel/events/core.c b/kernel/events/core.c > > index abbd4b3b96c2..e44c90378940 100644 > > --- a/kernel/events/core.c > > +++ b/kernel/events/core.c > > @@ -5005,6 +5005,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) > > if (perf_event_check_period(event, value)) > > return -EINVAL; > > > > + if (!event->attr.freq && (value & (1ULL << 63))) > > + return -EINVAL; > > Well, perf_event_attr::sample_period is __u64. Would not be the site > using it as signed be the one in error? You forgot to mention commit: 0819b2e30ccb9, so I guess this just makes it consistent and is fine.
On 5/13/19 2:26 PM, Peter Zijlstra wrote: > On Mon, May 13, 2019 at 09:42:13AM +0200, Peter Zijlstra wrote: >> On Sat, May 11, 2019 at 08:12:16AM +0530, Ravi Bangoria wrote: >>> Add a check for sample_period value sent from userspace. Negative >>> value does not make sense. And in powerpc arch code this could cause >>> a recursive PMI leading to a hang (reported when running perf-fuzzer). >>> >>> Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com> >>> --- >>> kernel/events/core.c | 3 +++ >>> 1 file changed, 3 insertions(+) >>> >>> diff --git a/kernel/events/core.c b/kernel/events/core.c >>> index abbd4b3b96c2..e44c90378940 100644 >>> --- a/kernel/events/core.c >>> +++ b/kernel/events/core.c >>> @@ -5005,6 +5005,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) >>> if (perf_event_check_period(event, value)) >>> return -EINVAL; >>> >>> + if (!event->attr.freq && (value & (1ULL << 63))) >>> + return -EINVAL; >> >> Well, perf_event_attr::sample_period is __u64. Would not be the site >> using it as signed be the one in error? > > You forgot to mention commit: 0819b2e30ccb9, so I guess this just makes > it consistent and is fine. > Yeah, I was about to reply :)
Ravi Bangoria <ravi.bangoria@linux.ibm.com> writes: > On 5/13/19 2:26 PM, Peter Zijlstra wrote: >> On Mon, May 13, 2019 at 09:42:13AM +0200, Peter Zijlstra wrote: >>> On Sat, May 11, 2019 at 08:12:16AM +0530, Ravi Bangoria wrote: >>>> Add a check for sample_period value sent from userspace. Negative >>>> value does not make sense. And in powerpc arch code this could cause >>>> a recursive PMI leading to a hang (reported when running perf-fuzzer). >>>> >>>> Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com> >>>> --- >>>> kernel/events/core.c | 3 +++ >>>> 1 file changed, 3 insertions(+) >>>> >>>> diff --git a/kernel/events/core.c b/kernel/events/core.c >>>> index abbd4b3b96c2..e44c90378940 100644 >>>> --- a/kernel/events/core.c >>>> +++ b/kernel/events/core.c >>>> @@ -5005,6 +5005,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) >>>> if (perf_event_check_period(event, value)) >>>> return -EINVAL; >>>> >>>> + if (!event->attr.freq && (value & (1ULL << 63))) >>>> + return -EINVAL; >>> >>> Well, perf_event_attr::sample_period is __u64. Would not be the site >>> using it as signed be the one in error? >> >> You forgot to mention commit: 0819b2e30ccb9, so I guess this just makes >> it consistent and is fine. >> > > Yeah, I was about to reply :) I've taken patch 2. You should probably do a v2 of patch 1 with an updated change log that explains things fully? cheers
diff --git a/kernel/events/core.c b/kernel/events/core.c index abbd4b3b96c2..e44c90378940 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5005,6 +5005,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) if (perf_event_check_period(event, value)) return -EINVAL; + if (!event->attr.freq && (value & (1ULL << 63))) + return -EINVAL; + event_function_call(event, __perf_event_period, &value); return 0;
Add a check for sample_period value sent from userspace. Negative value does not make sense. And in powerpc arch code this could cause a recursive PMI leading to a hang (reported when running perf-fuzzer). Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com> --- kernel/events/core.c | 3 +++ 1 file changed, 3 insertions(+)