From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3zvM1S72lZzF09H for ; Sun, 4 Mar 2018 22:55:37 +1100 (AEDT) Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w24BrrvK035983 for ; Sun, 4 Mar 2018 06:55:34 -0500 Received: from e06smtp13.uk.ibm.com (e06smtp13.uk.ibm.com [195.75.94.109]) by mx0a-001b2d01.pphosted.com with ESMTP id 2gg9j1hjxw-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Sun, 04 Mar 2018 06:55:34 -0500 Received: from localhost by e06smtp13.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Sun, 4 Mar 2018 11:55:32 -0000 From: Madhavan Srinivasan To: mpe@ellerman.id.au Cc: linuxppc-dev@lists.ozlabs.org, Madhavan Srinivasan Subject: [PATCH 1/2] powerpc/perf: Fix kernel address leak to userspace via BHRB buffer Date: Sun, 4 Mar 2018 17:25:17 +0530 Message-Id: <1520164518-19097-1-git-send-email-maddy@linux.vnet.ibm.com> List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , The current Branch History Rolling Buffer (BHRB) code does not check for any privilege levels before updating the data from BHRB. This leaks kernel addresses to userspace even when profiling only with userspace privileges. Add proper checks to prevent it. Signed-off-by: Madhavan Srinivasan --- arch/powerpc/perf/core-book3s.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c index f89bbd54ecec..337db5831749 100644 --- a/arch/powerpc/perf/core-book3s.c +++ b/arch/powerpc/perf/core-book3s.c @@ -457,6 +457,10 @@ static void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) /* invalid entry */ continue; + if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN) && + is_kernel_addr(addr)) + continue; + /* Branches are read most recent first (ie. mfbhrb 0 is * the most recent branch). * There are two types of valid entries: -- 2.7.4