perf_event_open: switch to copy_struct_from_user()
Switch perf_event_open() syscall from it's own copying struct perf_event_attr from userspace to the new dedicated copy_struct_from_user() helper. The change is very straightforward, and helps unify the syscall interface for struct-from-userspace syscalls. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com> [christian.brauner@ubuntu.com: improve commit message] Link: https://lore.kernel.org/r/20191001011055.19283-5-cyphar@cyphar.com Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
This commit is contained in:
parent
dff3a85fec
commit
c2ba8f41ad
@ -10586,55 +10586,26 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
|
||||
u32 size;
|
||||
int ret;
|
||||
|
||||
if (!access_ok(uattr, PERF_ATTR_SIZE_VER0))
|
||||
return -EFAULT;
|
||||
|
||||
/*
|
||||
* zero the full structure, so that a short copy will be nice.
|
||||
*/
|
||||
/* Zero the full structure, so that a short copy will be nice. */
|
||||
memset(attr, 0, sizeof(*attr));
|
||||
|
||||
ret = get_user(size, &uattr->size);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
if (size > PAGE_SIZE) /* silly large */
|
||||
goto err_size;
|
||||
|
||||
if (!size) /* abi compat */
|
||||
/* ABI compatibility quirk: */
|
||||
if (!size)
|
||||
size = PERF_ATTR_SIZE_VER0;
|
||||
|
||||
if (size < PERF_ATTR_SIZE_VER0)
|
||||
if (size < PERF_ATTR_SIZE_VER0 || size > PAGE_SIZE)
|
||||
goto err_size;
|
||||
|
||||
/*
|
||||
* If we're handed a bigger struct than we know of,
|
||||
* ensure all the unknown bits are 0 - i.e. new
|
||||
* user-space does not rely on any kernel feature
|
||||
* extensions we dont know about yet.
|
||||
*/
|
||||
if (size > sizeof(*attr)) {
|
||||
unsigned char __user *addr;
|
||||
unsigned char __user *end;
|
||||
unsigned char val;
|
||||
|
||||
addr = (void __user *)uattr + sizeof(*attr);
|
||||
end = (void __user *)uattr + size;
|
||||
|
||||
for (; addr < end; addr++) {
|
||||
ret = get_user(val, addr);
|
||||
if (ret)
|
||||
return ret;
|
||||
if (val)
|
||||
goto err_size;
|
||||
}
|
||||
size = sizeof(*attr);
|
||||
ret = copy_struct_from_user(attr, sizeof(*attr), uattr, size);
|
||||
if (ret) {
|
||||
if (ret == -E2BIG)
|
||||
goto err_size;
|
||||
return ret;
|
||||
}
|
||||
|
||||
ret = copy_from_user(attr, uattr, size);
|
||||
if (ret)
|
||||
return -EFAULT;
|
||||
|
||||
attr->size = size;
|
||||
|
||||
if (attr->__reserved_1)
|
||||
|
Loading…
Reference in New Issue
Block a user