Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cdf8073d authored by Ian Schram's avatar Ian Schram Committed by Ingo Molnar
Browse files

perf_counter: Fix perf_copy_attr() pointer arithmetic 



There is still some weird code in per_copy_attr(). Which supposedly
checks that all bytes trailing a struct are zero.

It doesn't seem to get pointer arithmetic right. Since it
increments an iterating pointer by sizeof(unsigned long) rather
than 1.

Signed-off-by: default avatarIan Schram <ischram@telenet.be>
[ v2: clean up the messy PTR_ALIGN logic as well. ]
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: <stable@kernel.org> # for v2.6.31.x
LKML-Reference: <4AB3DEE2.3030600@telenet.be>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
parent ec60a3fe

kernel/perf_counter.c

+10 −10
Original line number Diff line number Diff line
@@ -4208,8 +4208,8 @@ perf_counter_alloc(struct perf_counter_attr *attr, 
static int perf_copy_attr(struct perf_counter_attr __user *uattr,

			  struct perf_counter_attr *attr)

{

	int ret;

	u32 size;

	int ret;



	if (!access_ok(VERIFY_WRITE, uattr, PERF_ATTR_SIZE_VER0))

		return -EFAULT;
@@ -4234,19 +4234,19 @@ static int perf_copy_attr(struct perf_counter_attr __user *uattr, 


	/*

	 * If we're handed a bigger struct than we know of,

	 * ensure all the unknown bits are 0.

	 * ensure all the unknown bits are 0 - i.e. new

	 * user-space does not rely on any kernel feature

	 * extensions we dont know about yet.

	 */

	if (size > sizeof(*attr)) {

		unsigned long val;

		unsigned long __user *addr;

		unsigned long __user *end;

		unsigned char __user *addr;

		unsigned char __user *end;

		unsigned char val;



		addr = PTR_ALIGN((void __user *)uattr + sizeof(*attr),

				sizeof(unsigned long));

		end  = PTR_ALIGN((void __user *)uattr + size,

				sizeof(unsigned long));

		addr = (void __user *)uattr + sizeof(*attr);

		end  = (void __user *)uattr + size;



		for (; addr < end; addr += sizeof(unsigned long)) {

		for (; addr < end; addr++) {

			ret = get_user(val, addr);

			if (ret)

				return ret;