From: Luis Henriques <luis.henriques@canonical.com>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
kernel-team@lists.ubuntu.com
Cc: Stephen Boyd <sboyd@codeaurora.org>,
Russell King <rmk+kernel@arm.linux.org.uk>,
Luis Henriques <luis.henriques@canonical.com>
Subject: [PATCH 32/58] ARM: 7810/1: perf: Fix array out of bounds access in armpmu_map_hw_event()
Date: Mon, 2 Sep 2013 09:54:17 +0100 [thread overview]
Message-ID: <1378112083-9475-33-git-send-email-luis.henriques@canonical.com> (raw)
In-Reply-To: <1378112083-9475-1-git-send-email-luis.henriques@canonical.com>
3.5.7.21 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <sboyd@codeaurora.org>
commit d9f966357b14e356dbd83b8f4a197a287ab4ff83 upstream.
Vince Weaver reports an oops in the ARM perf event code while
running his perf_fuzzer tool on a pandaboard running v3.11-rc4.
Unable to handle kernel paging request at virtual address 73fd14cc
pgd = eca6c000
[73fd14cc] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: snd_soc_omap_hdmi omapdss snd_soc_omap_abe_twl6040 snd_soc_twl6040 snd_soc_omap snd_soc_omap_hdmi_card snd_soc_omap_mcpdm snd_soc_omap_mcbsp snd_soc_core snd_compress regmap_spi snd_pcm snd_page_alloc snd_timer snd soundcore
CPU: 1 PID: 2790 Comm: perf_fuzzer Not tainted 3.11.0-rc4 #6
task: eddcab80 ti: ed892000 task.ti: ed892000
PC is at armpmu_map_event+0x20/0x88
LR is at armpmu_event_init+0x38/0x280
pc : [<c001c3e4>] lr : [<c001c17c>] psr: 60000013
sp : ed893e40 ip : ecececec fp : edfaec00
r10: 00000000 r9 : 00000000 r8 : ed8c3ac0
r7 : ed8c3b5c r6 : edfaec00 r5 : 00000000 r4 : 00000000
r3 : 000000ff r2 : c0496144 r1 : c049611c r0 : edfaec00
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c5387d Table: aca6c04a DAC: 00000015
Process perf_fuzzer (pid: 2790, stack limit = 0xed892240)
Stack: (0xed893e40 to 0xed894000)
3e40: 00000800 c001c17c 00000002 c008a748 00000001 00000000 00000000 c00bf078
3e60: 00000000 edfaee50 00000000 00000000 00000000 edfaec00 ed8c3ac0 edfaec00
3e80: 00000000 c073ffac ed893f20 c00bf180 00000001 00000000 c00bf078 ed893f20
3ea0: 00000000 ed8c3ac0 00000000 00000000 00000000 c0cb0818 eddcab80 c00bf440
3ec0: ed893f20 00000000 eddcab80 eca76800 00000000 eca76800 00000000 00000000
3ee0: 00000000 ec984c80 eddcab80 c00bfe68 00000000 00000000 00000000 00000080
3f00: 00000000 ed892000 00000000 ed892030 00000004 ecc7e3c8 ecc7e3c8 00000000
3f20: 00000000 00000048 ecececec 00000000 00000000 00000000 00000000 00000000
3f40: 00000000 00000000 00297810 00000000 00000000 00000000 00000000 00000000
3f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3f80: 00000002 00000002 000103a4 00000002 0000016c c00128e8 ed892000 00000000
3fa0: 00090998 c0012700 00000002 000103a4 00090ab8 00000000 00000000 0000000f
3fc0: 00000002 000103a4 00000002 0000016c 00090ab0 00090ab8 000107a0 00090998
3fe0: bed92be0 bed92bd0 0000b785 b6e8f6d0 40000010 00090ab8 00000000 00000000
[<c001c3e4>] (armpmu_map_event+0x20/0x88) from [<c001c17c>] (armpmu_event_init+0x38/0x280)
[<c001c17c>] (armpmu_event_init+0x38/0x280) from [<c00bf180>] (perf_init_event+0x108/0x180)
[<c00bf180>] (perf_init_event+0x108/0x180) from [<c00bf440>] (perf_event_alloc+0x248/0x40c)
[<c00bf440>] (perf_event_alloc+0x248/0x40c) from [<c00bfe68>] (SyS_perf_event_open+0x4f4/0x8fc)
[<c00bfe68>] (SyS_perf_event_open+0x4f4/0x8fc) from [<c0012700>] (ret_fast_syscall+0x0/0x48)
Code: 0a000005 e3540004 0a000016 e3540000 (0791010c)
This is because event->attr.config in armpmu_event_init()
contains a very large number copied directly from userspace and
is never checked against the size of the array indexed in
armpmu_map_hw_event(). Fix the problem by checking the value of
config before indexing the array and rejecting invalid config
values.
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/kernel/perf_event.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 522c11d..54fbd46 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -109,7 +109,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
static int
armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
{
- int mapping = (*event_map)[config];
+ int mapping;
+
+ if (config >= PERF_COUNT_HW_MAX)
+ return -EINVAL;
+
+ mapping = (*event_map)[config];
return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
}
--
1.8.3.2
next prev parent reply other threads:[~2013-09-02 9:06 UTC|newest]
Thread overview: 59+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-02 8:53 [ 3.5.y.z extended stable ] Linux 3.5.7.21 stable review Luis Henriques
2013-09-02 8:53 ` [PATCH 01/58] drm/i915/lvds: ditch ->prepare special case Luis Henriques
2013-09-02 8:53 ` [PATCH 02/58] ALSA: usb: Parse UAC2 extension unit like for UAC1 Luis Henriques
2013-09-02 8:53 ` [PATCH 03/58] serial: mxs: fix buffer overflow Luis Henriques
2013-09-02 8:53 ` [PATCH 04/58] fs/proc/task_mmu.c: fix buffer overflow in add_page_map() Luis Henriques
2013-09-02 8:53 ` [PATCH 05/58] af_key: initialize satype in key_notify_policy_flush() Luis Henriques
2013-09-02 8:53 ` [PATCH 06/58] vm: add no-mmu vm_iomap_memory() stub Luis Henriques
2013-09-02 8:53 ` [PATCH 07/58] iwl4965: set power mode early Luis Henriques
2013-09-02 8:53 ` [PATCH 08/58] iwl4965: reset firmware after rfkill off Luis Henriques
2013-09-02 8:53 ` [PATCH 09/58] ASoC: cs42l52: Reorder Min/Max and update to SX_TLV for Beep Volume Luis Henriques
2013-09-02 8:53 ` [PATCH 10/58] can: pcan_usb: fix wrong memcpy() bytes length Luis Henriques
2013-09-02 8:53 ` [PATCH 11/58] ALSA: 6fire: make buffers DMA-able (pcm) Luis Henriques
2013-09-02 8:53 ` [PATCH 12/58] ALSA: 6fire: make buffers DMA-able (midi) Luis Henriques
2013-09-02 8:53 ` [PATCH 13/58] jbd2: Fix use after free after error in jbd2_journal_dirty_metadata() Luis Henriques
2013-09-02 8:53 ` [PATCH 14/58] USB-Serial: Fix error handling of usb_wwan Luis Henriques
2013-09-02 8:54 ` [PATCH 15/58] USB: mos7840: fix big-endian probe Luis Henriques
2013-09-02 8:54 ` [PATCH 16/58] USB: adutux: fix big-endian device-type reporting Luis Henriques
2013-09-02 8:54 ` [PATCH 17/58] USB: ti_usb_3410_5052: fix big-endian firmware handling Luis Henriques
2013-09-02 8:54 ` [PATCH 18/58] ARM: 7809/1: perf: fix event validation for software group leaders Luis Henriques
2013-09-02 8:54 ` [PATCH 19/58] m68k/atari: ARAnyM - Fix NatFeat module support Luis Henriques
2013-09-02 8:54 ` [PATCH 20/58] m68k: Truncate base in do_div() Luis Henriques
2013-09-02 8:54 ` [PATCH 21/58] usb: add two quirky touchscreen Luis Henriques
2013-09-02 8:54 ` [PATCH 22/58] USB: mos7720: fix broken control requests Luis Henriques
2013-09-02 8:54 ` [PATCH 23/58] USB: keyspan: fix null-deref at disconnect and release Luis Henriques
2013-09-02 8:54 ` [PATCH 24/58] MIPS: Expose missing pci_io{map,unmap} declarations Luis Henriques
2013-09-02 8:54 ` [PATCH 25/58] microblaze: Update microblaze defconfigs Luis Henriques
2013-09-02 8:54 ` [PATCH 26/58] sound: Fix make allmodconfig on MIPS Luis Henriques
2013-09-02 8:54 ` [PATCH 27/58] sound: Fix make allmodconfig on MIPS correctly Luis Henriques
2013-09-02 8:54 ` [PATCH 28/58] alpha: makefile: don't enforce small data model for kernel builds Luis Henriques
2013-09-02 8:54 ` [PATCH 29/58] MIPS: Rewrite pfn_valid to work in modules, too Luis Henriques
2013-09-02 8:54 ` [PATCH 30/58] xtensa: fix linker script transformation for .text.unlikely Luis Henriques
2013-09-02 8:54 ` [PATCH 31/58] wusbcore: fix kernel panic when disconnecting a wireless USB->serial device Luis Henriques
2013-09-02 8:54 ` Luis Henriques [this message]
2013-09-02 8:54 ` [PATCH 33/58] iwlwifi: dvm: fix calling ieee80211_chswitch_done() with NULL Luis Henriques
2013-09-02 8:54 ` [PATCH 34/58] iwlwifi: pcie: disable L1 Active after pci_enable_device Luis Henriques
2013-09-02 8:54 ` [PATCH 35/58] zd1201: do not use stack as URB transfer_buffer Luis Henriques
2013-09-02 8:54 ` [PATCH 36/58] Hostap: copying wrong data prism2_ioctl_giwaplist() Luis Henriques
2013-09-02 8:54 ` [PATCH 37/58] ARM: at91/DT: fix at91sam9n12ek memory node Luis Henriques
2013-09-02 8:54 ` [PATCH 38/58] drm/i915: Invalidate TLBs for the rings after a reset Luis Henriques
2013-09-02 8:54 ` [PATCH 39/58] libata: apply behavioral quirks to sil3826 PMP Luis Henriques
2013-09-02 8:54 ` [PATCH 40/58] ARM: davinci: nand: specify ecc strength Luis Henriques
2013-09-02 8:54 ` [PATCH 41/58] ARM: 7816/1: CONFIG_KUSER_HELPERS: fix help text Luis Henriques
2013-09-02 8:54 ` [PATCH 42/58] sata_fsl: save irqs while coalescing Luis Henriques
2013-09-02 8:54 ` [PATCH 43/58] xen/events: initialize local per-cpu mask for all possible events Luis Henriques
2013-09-02 8:54 ` [PATCH 44/58] of: fdt: fix memory initialization for expanded DT Luis Henriques
2013-09-02 8:54 ` [PATCH 45/58] [SCSI] zfcp: fix lock imbalance by reworking request queue locking Luis Henriques
2013-09-02 8:54 ` [PATCH 46/58] [SCSI] zfcp: fix schedule-inside-lock in scsi_device list loops Luis Henriques
2013-09-02 8:54 ` [PATCH 47/58] nilfs2: remove double bio_put() in nilfs_end_bio_write() for BIO_EOPNOTSUPP error Luis Henriques
2013-09-02 8:54 ` [PATCH 48/58] nilfs2: fix issue with counting number of bio requests for BIO_EOPNOTSUPP error detection Luis Henriques
2013-09-02 8:54 ` [PATCH 49/58] Bluetooth: Add support for Atheros [0cf3:3121] Luis Henriques
2013-09-02 8:54 ` [PATCH 50/58] efivars: explicitly calculate length of VariableName Luis Henriques
2013-09-02 8:54 ` [PATCH 51/58] workqueue: fix possible stall on try_to_grab_pending() of a delayed work item Luis Henriques
2013-09-02 8:54 ` [PATCH 52/58] x86/xen: do not identity map UNUSABLE regions in the machine E820 Luis Henriques
2013-09-02 8:54 ` [PATCH 53/58] jfs: fix readdir cookie incompatibility with NFSv4 Luis Henriques
2013-09-02 8:54 ` [PATCH 54/58] powerpc: Don't Oops when accessing /proc/powerpc/lparcfg without hypervisor Luis Henriques
2013-09-02 8:54 ` [PATCH 55/58] powerpc: Work around gcc miscompilation of __pa() on 64-bit Luis Henriques
2013-09-02 8:54 ` [PATCH 56/58] powerpc/hvsi: Increase handshake timeout from 200ms to 400ms Luis Henriques
2013-09-02 8:54 ` [PATCH 57/58] drivers/base/memory.c: fix show_mem_removable() to handle missing sections Luis Henriques
2013-09-02 8:54 ` [PATCH 58/58] x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member Luis Henriques
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1378112083-9475-33-git-send-email-luis.henriques@canonical.com \
--to=luis.henriques@canonical.com \
--cc=kernel-team@lists.ubuntu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rmk+kernel@arm.linux.org.uk \
--cc=sboyd@codeaurora.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®