lkml.org 
[lkml]   [2018]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 59/62] perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[]
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Peter Zijlstra <peterz@infradead.org>

    commit 4411ec1d1993e8dbff2898390e3fed280d88e446 upstream.

    > kernel/events/ring_buffer.c:871 perf_mmap_to_page() warn: potential spectre issue 'rb->aux_pages'

    Userspace controls @pgoff through the fault address. Sanitize the
    array index before doing the array dereference.

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Cc: <stable@kernel.org>
    Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Stephane Eranian <eranian@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Vince Weaver <vincent.weaver@maine.edu>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/events/ring_buffer.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    --- a/kernel/events/ring_buffer.c
    +++ b/kernel/events/ring_buffer.c
    @@ -14,6 +14,7 @@
    #include <linux/slab.h>
    #include <linux/circ_buf.h>
    #include <linux/poll.h>
    +#include <linux/nospec.h>

    #include "internal.h"

    @@ -863,8 +864,10 @@ perf_mmap_to_page(struct ring_buffer *rb
    return NULL;

    /* AUX space */
    - if (pgoff >= rb->aux_pgoff)
    - return virt_to_page(rb->aux_pages[pgoff - rb->aux_pgoff]);
    + if (pgoff >= rb->aux_pgoff) {
    + int aux_pgoff = array_index_nospec(pgoff - rb->aux_pgoff, rb->aux_nr_pages);
    + return virt_to_page(rb->aux_pages[aux_pgoff]);
    + }
    }

    return __perf_mmap_to_page(rb, pgoff);

    \
     
     \ /
      Last update: 2018-05-14 09:22    [W:7.895 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site