perf_counter: Fix perf_copy_attr() pointer arithmetic
There is still some weird code in per_copy_attr(). Which supposedly checks that all bytes trailing a struct are zero. It doesn't seem to get pointer arithmetic right. Since it increments an iterating pointer by sizeof(unsigned long) rather than 1. Signed-off-by: Ian Schram <ischram@telenet.be> [ v2: clean up the messy PTR_ALIGN logic as well. ] Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Mike Galbraith <efault@gmx.de> Cc: Paul Mackerras <paulus@samba.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: <stable@kernel.org> # for v2.6.31.x LKML-Reference: <4AB3DEE2.3030600@telenet.be> Signed-off-by: Ingo Molnar <mingo@elte.hu>
This commit is contained in:
parent
ec60a3fe47
commit
cdf8073d6b
|
@ -4208,8 +4208,8 @@ done:
|
|||
static int perf_copy_attr(struct perf_counter_attr __user *uattr,
|
||||
struct perf_counter_attr *attr)
|
||||
{
|
||||
int ret;
|
||||
u32 size;
|
||||
int ret;
|
||||
|
||||
if (!access_ok(VERIFY_WRITE, uattr, PERF_ATTR_SIZE_VER0))
|
||||
return -EFAULT;
|
||||
|
@ -4234,19 +4234,19 @@ static int perf_copy_attr(struct perf_counter_attr __user *uattr,
|
|||
|
||||
/*
|
||||
* If we're handed a bigger struct than we know of,
|
||||
* ensure all the unknown bits are 0.
|
||||
* ensure all the unknown bits are 0 - i.e. new
|
||||
* user-space does not rely on any kernel feature
|
||||
* extensions we dont know about yet.
|
||||
*/
|
||||
if (size > sizeof(*attr)) {
|
||||
unsigned long val;
|
||||
unsigned long __user *addr;
|
||||
unsigned long __user *end;
|
||||
unsigned char __user *addr;
|
||||
unsigned char __user *end;
|
||||
unsigned char val;
|
||||
|
||||
addr = PTR_ALIGN((void __user *)uattr + sizeof(*attr),
|
||||
sizeof(unsigned long));
|
||||
end = PTR_ALIGN((void __user *)uattr + size,
|
||||
sizeof(unsigned long));
|
||||
addr = (void __user *)uattr + sizeof(*attr);
|
||||
end = (void __user *)uattr + size;
|
||||
|
||||
for (; addr < end; addr += sizeof(unsigned long)) {
|
||||
for (; addr < end; addr++) {
|
||||
ret = get_user(val, addr);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
|
Loading…
Reference in a new issue