From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934622AbcIPL7z (ORCPT ); Fri, 16 Sep 2016 07:59:55 -0400 Received: from terminus.zytor.com ([198.137.202.10]:40406 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934425AbcIPL7n (ORCPT ); Fri, 16 Sep 2016 07:59:43 -0400 Date: Fri, 16 Sep 2016 04:58:58 -0700 From: tip-bot for Alexander Shishkin Message-ID: Cc: linux-kernel@vger.kernel.org, jolsa@redhat.com, eranian@google.com, hpa@zytor.com, mingo@kernel.org, acme@infradead.org, a.p.zijlstra@chello.nl, alexander.shishkin@linux.intel.com, peterz@infradead.org, vincent.weaver@maine.edu, adrian.hunter@intel.com, torvalds@linux-foundation.org, tglx@linutronix.de, acme@redhat.com Reply-To: eranian@google.com, jolsa@redhat.com, linux-kernel@vger.kernel.org, acme@infradead.org, a.p.zijlstra@chello.nl, hpa@zytor.com, mingo@kernel.org, vincent.weaver@maine.edu, adrian.hunter@intel.com, alexander.shishkin@linux.intel.com, peterz@infradead.org, torvalds@linux-foundation.org, tglx@linutronix.de, acme@redhat.com In-Reply-To: <20160915151352.21306-4-alexander.shishkin@linux.intel.com> References: <20160915151352.21306-4-alexander.shishkin@linux.intel.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/urgent] perf/x86/intel/pt: Do validate the size of a kernel address filter Git-Commit-ID: 1155bafcb79208abc6ae234c6e135ac70607755c X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 1155bafcb79208abc6ae234c6e135ac70607755c Gitweb: http://git.kernel.org/tip/1155bafcb79208abc6ae234c6e135ac70607755c Author: Alexander Shishkin AuthorDate: Thu, 15 Sep 2016 18:13:52 +0300 Committer: Ingo Molnar CommitDate: Fri, 16 Sep 2016 11:14:16 +0200 perf/x86/intel/pt: Do validate the size of a kernel address filter Right now, the kernel address filters in PT are prone to integer overflow that may happen in adding filter's size to its offset to obtain the end of the range. Such an overflow would also throw a #GP in the PT event configuration path. Fix this by explicitly validating the result of this calculation. Reported-by: Adrian Hunter Signed-off-by: Alexander Shishkin Acked-by: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: stable@vger.kernel.org # v4.7 Cc: stable@vger.kernel.org#v4.7 Cc: vince@deater.net Link: http://lkml.kernel.org/r/20160915151352.21306-4-alexander.shishkin@linux.intel.com Signed-off-by: Ingo Molnar --- arch/x86/events/intel/pt.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c index 1f94963..861a7d9 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -1089,8 +1089,13 @@ static int pt_event_addr_filters_validate(struct list_head *filters) if (!filter->range || !filter->size) return -EOPNOTSUPP; - if (!filter->inode && !valid_kernel_ip(filter->offset)) - return -EINVAL; + if (!filter->inode) { + if (!valid_kernel_ip(filter->offset)) + return -EINVAL; + + if (!valid_kernel_ip(filter->offset + filter->size)) + return -EINVAL; + } if (++range > pt_cap_get(PT_CAP_num_address_ranges)) return -EOPNOTSUPP;