Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc6ca7b3 authored by Arun Sharma's avatar Arun Sharma Committed by Ingo Molnar
Browse files

perf/x86: Check if user fp is valid 



Signed-off-by: default avatarArun Sharma <asharma@fb.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1334961696-19580-4-git-send-email-asharma@fb.com


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 0b0d9cf6

arch/x86/include/asm/uaccess.h

+6 −6
Original line number Original line Diff line number Diff line
@@ -34,8 +34,7 @@ 




#define user_addr_max() (current_thread_info()->addr_limit.seg)

#define user_addr_max() (current_thread_info()->addr_limit.seg)

#define __addr_ok(addr) 	\

#define __addr_ok(addr) 	\

	((unsigned long __force)(addr) <		\

	((unsigned long __force)(addr) < user_addr_max())

	 (current_thread_info()->addr_limit.seg))





/*

/*

 * Test whether a block of memory is a valid user space address.

 * Test whether a block of memory is a valid user space address.
@@ -47,14 +46,14 @@ 
 * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...

 * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...

 */

 */





#define __range_not_ok(addr, size)					\

#define __range_not_ok(addr, size, limit)				\

({									\

({									\

	unsigned long flag, roksum;					\

	unsigned long flag, roksum;					\

	__chk_user_ptr(addr);						\

	__chk_user_ptr(addr);						\

	asm("add %3,%1 ; sbb %0,%0 ; cmp %1,%4 ; sbb $0,%0"		\

	asm("add %3,%1 ; sbb %0,%0 ; cmp %1,%4 ; sbb $0,%0"		\

	    : "=&r" (flag), "=r" (roksum)				\

	    : "=&r" (flag), "=r" (roksum)				\

	    : "1" (addr), "g" ((long)(size)),				\

	    : "1" (addr), "g" ((long)(size)),				\

	      "rm" (current_thread_info()->addr_limit.seg));		\

	      "rm" (limit));						\

	flag;								\

	flag;								\

})

})
@@ -77,7 +76,8 @@ 
 * checks that the pointer is in the user space range - after calling

 * checks that the pointer is in the user space range - after calling

 * this function, memory access functions may still return -EFAULT.

 * this function, memory access functions may still return -EFAULT.

 */

 */

#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))

#define access_ok(type, addr, size) \

	(likely(__range_not_ok(addr, size, user_addr_max()) == 0))





/*

/*

 * The exception table consists of pairs of addresses relative to the

 * The exception table consists of pairs of addresses relative to the

arch/x86/kernel/cpu/perf_event.c

+12 −0
Original line number Original line Diff line number Diff line
@@ -1757,6 +1757,12 @@ perf_callchain_kernel(struct perf_callchain_entry *entry, struct pt_regs *regs) 
	dump_trace(NULL, regs, NULL, 0, &backtrace_ops, entry);

	dump_trace(NULL, regs, NULL, 0, &backtrace_ops, entry);

}

}





static inline int

valid_user_frame(const void __user *fp, unsigned long size)

{

	return (__range_not_ok(fp, size, TASK_SIZE) == 0);

}



#ifdef CONFIG_COMPAT

#ifdef CONFIG_COMPAT





#include <asm/compat.h>

#include <asm/compat.h>
@@ -1781,6 +1787,9 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry *entry) 
		if (bytes != sizeof(frame))

		if (bytes != sizeof(frame))

			break;

			break;





		if (!valid_user_frame(fp, sizeof(frame)))

			break;



		perf_callchain_store(entry, frame.return_address);

		perf_callchain_store(entry, frame.return_address);

		fp = compat_ptr(frame.next_frame);

		fp = compat_ptr(frame.next_frame);

	}

	}
@@ -1824,6 +1833,9 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) 
		if (bytes != sizeof(frame))

		if (bytes != sizeof(frame))

			break;

			break;





		if (!valid_user_frame(fp, sizeof(frame)))

			break;



		perf_callchain_store(entry, frame.return_address);

		perf_callchain_store(entry, frame.return_address);

		fp = frame.next_frame;

		fp = frame.next_frame;

	}

	}