linux-kernel - [tip:perf/urgent] perf/x86/intel/pt: Do validate the size of a kernel address filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 16 Sep 2016 04:58:58 -0700
From:   tip-bot for Alexander Shishkin <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, jolsa@...hat.com, eranian@...gle.com,
        hpa@...or.com, mingo@...nel.org, acme@...radead.org,
        a.p.zijlstra@...llo.nl, alexander.shishkin@...ux.intel.com,
        peterz@...radead.org, vincent.weaver@...ne.edu,
        adrian.hunter@...el.com, torvalds@...ux-foundation.org,
        tglx@...utronix.de, acme@...hat.com
Subject: [tip:perf/urgent] perf/x86/intel/pt: Do validate the size of a
 kernel address filter

Commit-ID:  1155bafcb79208abc6ae234c6e135ac70607755c
Gitweb:     http://git.kernel.org/tip/1155bafcb79208abc6ae234c6e135ac70607755c
Author:     Alexander Shishkin <alexander.shishkin@...ux.intel.com>
AuthorDate: Thu, 15 Sep 2016 18:13:52 +0300
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Fri, 16 Sep 2016 11:14:16 +0200

perf/x86/intel/pt: Do validate the size of a kernel address filter

Right now, the kernel address filters in PT are prone to integer overflow
that may happen in adding filter's size to its offset to obtain the end
of the range. Such an overflow would also throw a #GP in the PT event
configuration path.

Fix this by explicitly validating the result of this calculation.

Reported-by: Adrian Hunter <adrian.hunter@...el.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Acked-by: Peter Zijlstra <peterz@...radead.org>
Cc: Arnaldo Carvalho de Melo <acme@...radead.org>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Jiri Olsa <jolsa@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc: Stephane Eranian <eranian@...gle.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Vince Weaver <vincent.weaver@...ne.edu>
Cc: stable@...r.kernel.org # v4.7
Cc: stable@...r.kernel.org#v4.7
Cc: vince@...ter.net
Link: http://lkml.kernel.org/r/20160915151352.21306-4-alexander.shishkin@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/x86/events/intel/pt.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 1f94963..861a7d9 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1089,8 +1089,13 @@ static int pt_event_addr_filters_validate(struct list_head *filters)
 		if (!filter->range || !filter->size)
 			return -EOPNOTSUPP;
 
-		if (!filter->inode && !valid_kernel_ip(filter->offset))
-			return -EINVAL;
+		if (!filter->inode) {
+			if (!valid_kernel_ip(filter->offset))
+				return -EINVAL;
+
+			if (!valid_kernel_ip(filter->offset + filter->size))
+				return -EINVAL;
+		}
 
 		if (++range > pt_cap_get(PT_CAP_num_address_ranges))
 			return -EOPNOTSUPP;