lkml.org 
[lkml]   [2014]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[perf] yet another 32/64-bit range check failure

More fun found by the perf_fuzzer...

In kernel/events/core.c
SYSCALL_DEFINE5(perf_event_open,

We check if flags is valid like this:

/* for future expandability... */
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;

but flags is a 64-bit value but ~PERF_FLAG_ALL is 32-bit.

This means values like 0x800000000000ULL are treated as valid even though
they aren't.

This is allowing events to be allocated memory but not being freed somehow
before returning EINVAL (a memory leak).
At least it looks like this is happening in the huge traces I have trying
to track down the perf_fuzzer memory corruption bug.

I'd send a patch to fix the above, but it's late and I can't figure out
where exactly to stick ULL to get PERF_FLAG_ALL to be upgraded to 64-bit.

Vince


\
 
 \ /
  Last update: 2014-04-23 06:41    [W:0.136 / U:0.252 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site