diff options
| author | Ian Schram <ischram@telenet.be> | 2009-09-18 21:26:26 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-10-05 09:31:46 -0700 |
| commit | 45bc25843ee4c5c6183b6fba013fba1e11eb05b1 (patch) | |
| tree | 69922df542e987da6a53c2f0951a865135884e44 | |
| parent | c22044b960eef0dfd48c9b608defaf2c5c3e7880 (diff) | |
| download | linux-jz47xx-45bc25843ee4c5c6183b6fba013fba1e11eb05b1.tar.gz | |
perf_counter: Fix perf_copy_attr() pointer arithmetic
commit cdf8073d6b2c6c5a3cd6ce0e6c1297157f7f99ba upstream.
There is still some weird code in per_copy_attr(). Which supposedly
checks that all bytes trailing a struct are zero.
It doesn't seem to get pointer arithmetic right. Since it
increments an iterating pointer by sizeof(unsigned long) rather
than 1.
Signed-off-by: Ian Schram <ischram@telenet.be>
[ v2: clean up the messy PTR_ALIGN logic as well. ]
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
LKML-Reference: <4AB3DEE2.3030600@telenet.be>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | kernel/perf_counter.c | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c index 3f49f539356..b1dc4684e66 100644 --- a/kernel/perf_counter.c +++ b/kernel/perf_counter.c @@ -4143,8 +4143,8 @@ done: static int perf_copy_attr(struct perf_counter_attr __user *uattr, struct perf_counter_attr *attr) { - int ret; u32 size; + int ret; if (!access_ok(VERIFY_WRITE, uattr, PERF_ATTR_SIZE_VER0)) return -EFAULT; @@ -4169,19 +4169,19 @@ static int perf_copy_attr(struct perf_counter_attr __user *uattr, /* * If we're handed a bigger struct than we know of, - * ensure all the unknown bits are 0. + * ensure all the unknown bits are 0 - i.e. new + * user-space does not rely on any kernel feature + * extensions we dont know about yet. */ if (size > sizeof(*attr)) { - unsigned long val; - unsigned long __user *addr; - unsigned long __user *end; + unsigned char __user *addr; + unsigned char __user *end; + unsigned char val; - addr = PTR_ALIGN((void __user *)uattr + sizeof(*attr), - sizeof(unsigned long)); - end = PTR_ALIGN((void __user *)uattr + size, - sizeof(unsigned long)); + addr = (void __user *)uattr + sizeof(*attr); + end = (void __user *)uattr + size; - for (; addr < end; addr += sizeof(unsigned long)) { + for (; addr < end; addr++) { ret = get_user(val, addr); if (ret) return ret; |