diff options
| author | Nicholas Piggin <[email protected]> | 2022-11-27 22:49:28 +1000 |
|---|---|---|
| committer | Michael Ellerman <[email protected]> | 2022-12-02 17:54:07 +1100 |
| commit | 32c5209214bd8d4f8c4e9d9b630ef4c671f58e79 (patch) | |
| tree | f5d5018c08cff0072a51914eee1e97e798988532 /net/lapb/lapb_iface.c | |
| parent | d6aee468e4ecbfec46a3eafae4d31d6efc0d4da4 (diff) | |
powerpc/perf: callchain validate kernel stack pointer bounds
The interrupt frame detection and loads from the hypothetical pt_regs
are not bounds-checked. The next-frame validation only bounds-checks
STACK_FRAME_OVERHEAD, which does not include the pt_regs. Add another
test for this.
The user could set r1 to be equal to the address matching the first
interrupt frame - STACK_INT_FRAME_SIZE, which is in the previous page
due to the kernel redzone, and induce the kernel to load the marker from
there. Possibly this could cause a crash at least. If the user could
induce the previous page to contain a valid marker, then it might be
able to direct perf to read specific memory addresses in a way that
could be transmitted back to the user in the perf data.
Fixes: 20002ded4d93 ("perf_counter: powerpc: Add callchain support")
Signed-off-by: Nicholas Piggin <[email protected]>
Signed-off-by: Michael Ellerman <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Diffstat (limited to 'net/lapb/lapb_iface.c')
0 files changed, 0 insertions, 0 deletions