lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

perf_counter: Fix perf_copy_attr() pointer arithmetic

Browse Source 
There is still some weird code in per_copy_attr(). Which supposedly
checks that all bytes trailing a struct are zero.

It doesn't seem to get pointer arithmetic right. Since it
increments an iterating pointer by sizeof(unsigned long) rather
than 1.

Signed-off-by: Ian Schram <ischram@telenet.be>
[ v2: clean up the messy PTR_ALIGN logic as well. ]
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: <stable@kernel.org> # for v2.6.31.x
LKML-Reference: <4AB3DEE2.3030600@telenet.be>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
This commit is contained in:
Ian Schram
2009-09-18 21:26:26 +02:00
committed by Ingo Molnar
parent ec60a3fe47
commit cdf8073d6b
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
kernel/perf_counter.c
View File

@@ -4208,8 +4208,8 @@ done:
static int perf_copy_attr(struct perf_counter_attr __user *uattr, static int perf_copy_attr(struct perf_counter_attr __user *uattr,
struct perf_counter_attr *attr) struct perf_counter_attr *attr)
{ {
int ret;
u32 size; u32 size;
int ret;
if (!access_ok(VERIFY_WRITE, uattr, PERF_ATTR_SIZE_VER0)) if (!access_ok(VERIFY_WRITE, uattr, PERF_ATTR_SIZE_VER0))
return -EFAULT; return -EFAULT;
@@ -4234,19 +4234,19 @@ static int perf_copy_attr(struct perf_counter_attr __user *uattr,
/* /*
* If we're handed a bigger struct than we know of, * If we're handed a bigger struct than we know of,
* ensure all the unknown bits are 0. * ensure all the unknown bits are 0 - i.e. new
* user-space does not rely on any kernel feature
* extensions we dont know about yet.
*/ */
if (size > sizeof(*attr)) { if (size > sizeof(*attr)) {
unsigned long val; unsigned char __user *addr;
unsigned long __user *addr; unsigned char __user *end;
unsigned long __user *end; unsigned char val;
addr = PTR_ALIGN((void __user *)uattr + sizeof(*attr), addr = (void __user *)uattr + sizeof(*attr);
sizeof(unsigned long)); end = (void __user *)uattr + size;
end = PTR_ALIGN((void __user *)uattr + size,
sizeof(unsigned long));
for (; addr < end; addr += sizeof(unsigned long)) { for (; addr < end; addr++) {
ret = get_user(val, addr); ret = get_user(val, addr);
if (ret) if (ret)
return ret; return ret;