perf_event_open: switch to copy_struct_from_user()
Switch perf_event_open() syscall from it's own copying struct perf_event_attr from userspace to the new dedicated copy_struct_from_user() helper. The change is very straightforward, and helps unify the syscall interface for struct-from-userspace syscalls. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com> [christian.brauner@ubuntu.com: improve commit message] Link: https://lore.kernel.org/r/20191001011055.19283-5-cyphar@cyphar.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
This commit is contained in:
parent
dff3a85fec
commit
c2ba8f41ad
|
@ -10586,55 +10586,26 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
|
||||||
u32 size;
|
u32 size;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
if (!access_ok(uattr, PERF_ATTR_SIZE_VER0))
|
/* Zero the full structure, so that a short copy will be nice. */
|
||||||
return -EFAULT;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* zero the full structure, so that a short copy will be nice.
|
|
||||||
*/
|
|
||||||
memset(attr, 0, sizeof(*attr));
|
memset(attr, 0, sizeof(*attr));
|
||||||
|
|
||||||
ret = get_user(size, &uattr->size);
|
ret = get_user(size, &uattr->size);
|
||||||
if (ret)
|
if (ret)
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
if (size > PAGE_SIZE) /* silly large */
|
/* ABI compatibility quirk: */
|
||||||
goto err_size;
|
if (!size)
|
||||||
|
|
||||||
if (!size) /* abi compat */
|
|
||||||
size = PERF_ATTR_SIZE_VER0;
|
size = PERF_ATTR_SIZE_VER0;
|
||||||
|
if (size < PERF_ATTR_SIZE_VER0 || size > PAGE_SIZE)
|
||||||
if (size < PERF_ATTR_SIZE_VER0)
|
|
||||||
goto err_size;
|
goto err_size;
|
||||||
|
|
||||||
/*
|
ret = copy_struct_from_user(attr, sizeof(*attr), uattr, size);
|
||||||
* If we're handed a bigger struct than we know of,
|
if (ret) {
|
||||||
* ensure all the unknown bits are 0 - i.e. new
|
if (ret == -E2BIG)
|
||||||
* user-space does not rely on any kernel feature
|
goto err_size;
|
||||||
* extensions we dont know about yet.
|
return ret;
|
||||||
*/
|
|
||||||
if (size > sizeof(*attr)) {
|
|
||||||
unsigned char __user *addr;
|
|
||||||
unsigned char __user *end;
|
|
||||||
unsigned char val;
|
|
||||||
|
|
||||||
addr = (void __user *)uattr + sizeof(*attr);
|
|
||||||
end = (void __user *)uattr + size;
|
|
||||||
|
|
||||||
for (; addr < end; addr++) {
|
|
||||||
ret = get_user(val, addr);
|
|
||||||
if (ret)
|
|
||||||
return ret;
|
|
||||||
if (val)
|
|
||||||
goto err_size;
|
|
||||||
}
|
|
||||||
size = sizeof(*attr);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
ret = copy_from_user(attr, uattr, size);
|
|
||||||
if (ret)
|
|
||||||
return -EFAULT;
|
|
||||||
|
|
||||||
attr->size = size;
|
attr->size = size;
|
||||||
|
|
||||||
if (attr->__reserved_1)
|
if (attr->__reserved_1)
|
||||||
|
|
Loading…
Reference in New Issue