Commit-ID: 1155bafcb79208abc6ae234c6e135ac70607755c Gitweb: http://git.kernel.org/tip/1155bafcb79208abc6ae234c6e135ac70607755c Author: Alexander Shishkin <alexander.shish...@linux.intel.com> AuthorDate: Thu, 15 Sep 2016 18:13:52 +0300 Committer: Ingo Molnar <mi...@kernel.org> CommitDate: Fri, 16 Sep 2016 11:14:16 +0200
perf/x86/intel/pt: Do validate the size of a kernel address filter Right now, the kernel address filters in PT are prone to integer overflow that may happen in adding filter's size to its offset to obtain the end of the range. Such an overflow would also throw a #GP in the PT event configuration path. Fix this by explicitly validating the result of this calculation. Reported-by: Adrian Hunter <adrian.hun...@intel.com> Signed-off-by: Alexander Shishkin <alexander.shish...@linux.intel.com> Acked-by: Peter Zijlstra <pet...@infradead.org> Cc: Arnaldo Carvalho de Melo <a...@infradead.org> Cc: Arnaldo Carvalho de Melo <a...@redhat.com> Cc: Jiri Olsa <jo...@redhat.com> Cc: Linus Torvalds <torva...@linux-foundation.org> Cc: Peter Zijlstra <a.p.zijls...@chello.nl> Cc: Stephane Eranian <eran...@google.com> Cc: Thomas Gleixner <t...@linutronix.de> Cc: Vince Weaver <vincent.wea...@maine.edu> Cc: sta...@vger.kernel.org # v4.7 Cc: sta...@vger.kernel.org#v4.7 Cc: vi...@deater.net Link: http://lkml.kernel.org/r/20160915151352.21306-4-alexander.shish...@linux.intel.com Signed-off-by: Ingo Molnar <mi...@kernel.org> --- arch/x86/events/intel/pt.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c index 1f94963..861a7d9 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -1089,8 +1089,13 @@ static int pt_event_addr_filters_validate(struct list_head *filters) if (!filter->range || !filter->size) return -EOPNOTSUPP; - if (!filter->inode && !valid_kernel_ip(filter->offset)) - return -EINVAL; + if (!filter->inode) { + if (!valid_kernel_ip(filter->offset)) + return -EINVAL; + + if (!valid_kernel_ip(filter->offset + filter->size)) + return -EINVAL; + } if (++range > pt_cap_get(PT_CAP_num_address_ranges)) return -EOPNOTSUPP;
