mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 08:46:46 +00:00
powerpc/perf: callchain validate kernel stack pointer bounds
[ Upstream commit32c5209214
] The interrupt frame detection and loads from the hypothetical pt_regs are not bounds-checked. The next-frame validation only bounds-checks STACK_FRAME_OVERHEAD, which does not include the pt_regs. Add another test for this. The user could set r1 to be equal to the address matching the first interrupt frame - STACK_INT_FRAME_SIZE, which is in the previous page due to the kernel redzone, and induce the kernel to load the marker from there. Possibly this could cause a crash at least. If the user could induce the previous page to contain a valid marker, then it might be able to direct perf to read specific memory addresses in a way that could be transmitted back to the user in the perf data. Fixes:20002ded4d
("perf_counter: powerpc: Add callchain support") Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20221127124942.1665522-4-npiggin@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
5de1902244
commit
cf03db2896
1 changed files with 1 additions and 0 deletions
|
@ -61,6 +61,7 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re
|
||||||
next_sp = fp[0];
|
next_sp = fp[0];
|
||||||
|
|
||||||
if (next_sp == sp + STACK_INT_FRAME_SIZE &&
|
if (next_sp == sp + STACK_INT_FRAME_SIZE &&
|
||||||
|
validate_sp(sp, current, STACK_INT_FRAME_SIZE) &&
|
||||||
fp[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) {
|
fp[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) {
|
||||||
/*
|
/*
|
||||||
* This looks like an interrupt frame for an
|
* This looks like an interrupt frame for an
|
||||||
|
|
Loading…
Reference in a new issue