Skip to content

Commit fa73c0a

Browse files
ciq-sahlbergPlaidCat
authored andcommitted
perf: Fix perf_event_validate_size()
jira SECO-54 cve CVE-2023-6931 commit 382c27f upstream-diff trivial diff against upstream as we do not have PERF_FORMAT_LOST(119a784) in 8.8. PERF_FORMAT_LOST is a counter that was exposed to userspace post 8.8 so we do not need it backported. Budimir noted that perf_event_validate_size() only checks the size of the newly added event, even though the sizes of all existing events can also change due to not all events having the same read_format. When we attach the new event, perf_group_attach(), we do re-compute the size for all events. Fixes: a723968 ("perf: Fix u16 overflows") Reported-by: Budimir Markovic <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> (cherry picked from commit 382c27f) Signed-off-by: Ronnie Sahlberg <[email protected]>
1 parent db9d992 commit fa73c0a

File tree

1 file changed

+37
-22
lines changed

1 file changed

+37
-22
lines changed

kernel/events/core.c

Lines changed: 37 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1850,28 +1850,31 @@ static inline void perf_event__state_init(struct perf_event *event)
18501850
PERF_EVENT_STATE_INACTIVE;
18511851
}
18521852

1853-
static void __perf_event_read_size(struct perf_event *event, int nr_siblings)
1853+
static int __perf_event_read_size(u64 read_format, int nr_siblings)
18541854
{
18551855
int entry = sizeof(u64); /* value */
18561856
int size = 0;
18571857
int nr = 1;
18581858

1859-
if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
1859+
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
18601860
size += sizeof(u64);
18611861

1862-
if (event->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
1862+
if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
18631863
size += sizeof(u64);
18641864

1865-
if (event->attr.read_format & PERF_FORMAT_ID)
1865+
if (read_format & PERF_FORMAT_ID)
18661866
entry += sizeof(u64);
18671867

1868-
if (event->attr.read_format & PERF_FORMAT_GROUP) {
1868+
if (read_format & PERF_FORMAT_GROUP) {
18691869
nr += nr_siblings;
18701870
size += sizeof(u64);
18711871
}
18721872

1873-
size += entry * nr;
1874-
event->read_size = size;
1873+
/*
1874+
* Since perf_event_validate_size() limits this to 16k and inhibits
1875+
* adding more siblings, this will never overflow.
1876+
*/
1877+
return size + nr * entry;
18751878
}
18761879

18771880
static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
@@ -1921,8 +1924,9 @@ static void __perf_event_header_size(struct perf_event *event, u64 sample_type)
19211924
*/
19221925
static void perf_event__header_size(struct perf_event *event)
19231926
{
1924-
__perf_event_read_size(event,
1925-
event->group_leader->nr_siblings);
1927+
event->read_size =
1928+
__perf_event_read_size(event->attr.read_format,
1929+
event->group_leader->nr_siblings);
19261930
__perf_event_header_size(event, event->attr.sample_type);
19271931
}
19281932

@@ -1953,24 +1957,35 @@ static void perf_event__id_header_size(struct perf_event *event)
19531957
event->id_header_size = size;
19541958
}
19551959

1960+
/*
1961+
* Check that adding an event to the group does not result in anybody
1962+
* overflowing the 64k event limit imposed by the output buffer.
1963+
*
1964+
* Specifically, check that the read_size for the event does not exceed 16k,
1965+
* read_size being the one term that grows with groups size. Since read_size
1966+
* depends on per-event read_format, also (re)check the existing events.
1967+
*
1968+
* This leaves 48k for the constant size fields and things like callchains,
1969+
* branch stacks and register sets.
1970+
*/
19561971
static bool perf_event_validate_size(struct perf_event *event)
19571972
{
1958-
/*
1959-
* The values computed here will be over-written when we actually
1960-
* attach the event.
1961-
*/
1962-
__perf_event_read_size(event, event->group_leader->nr_siblings + 1);
1963-
__perf_event_header_size(event, event->attr.sample_type & ~PERF_SAMPLE_READ);
1964-
perf_event__id_header_size(event);
1973+
struct perf_event *sibling, *group_leader = event->group_leader;
19651974

1966-
/*
1967-
* Sum the lot; should not exceed the 64k limit we have on records.
1968-
* Conservative limit to allow for callchains and other variable fields.
1969-
*/
1970-
if (event->read_size + event->header_size +
1971-
event->id_header_size + sizeof(struct perf_event_header) >= 16*1024)
1975+
if (__perf_event_read_size(event->attr.read_format,
1976+
group_leader->nr_siblings + 1) > 16*1024)
19721977
return false;
19731978

1979+
if (__perf_event_read_size(group_leader->attr.read_format,
1980+
group_leader->nr_siblings + 1) > 16*1024)
1981+
return false;
1982+
1983+
for_each_sibling_event(sibling, group_leader) {
1984+
if (__perf_event_read_size(sibling->attr.read_format,
1985+
group_leader->nr_siblings + 1) > 16*1024)
1986+
return false;
1987+
}
1988+
19741989
return true;
19751990
}
19761991

0 commit comments

Comments
 (0)