From 08bf1b3700f94154a7459c8406b747500b5c6d81 Mon Sep 17 00:00:00 2001
From: Wish Wu <wishwu007@gmail.com>
Date: Mon, 21 Dec 2015 12:11:04 -0500
Subject: [PATCH] msm: null pointer dereferencing
Prevent unintended kernel NULL pointer dereferencing.
Code:
hlist_del_rcu(&event->hlist_entry);
Fix: Adding pointer check:
if(!hlist_unhashed(&p_event->hlist_entry))
hlist_del_rcu(&p_event->hlist_entry);
Bug: 25364034
Change-Id: Ib13a7400d4a36a4b08b0afc9b7d69c6027e741b6
Signed-off-by: Yuan Lin <yualin@google.com>
---
kernel/events/core.c | 6 +++++-
kernel/trace/trace_event_perf.c | 5 ++++-
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6c30eb5b4dfd..debb393cde11 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5339,7 +5339,8 @@ static int perf_swevent_add(struct perf_event *event, int flags)
static void perf_swevent_del(struct perf_event *event, int flags)
{
- hlist_del_rcu(&event->hlist_entry);
+ if(!hlist_unhashed(&event->hlist_entry))
+ hlist_del_rcu(&event->hlist_entry);
}
static void perf_swevent_start(struct perf_event *event, int flags)
@@ -6616,6 +6617,9 @@ SYSCALL_DEFINE5(perf_event_open,
if (err)
return err;
+ if (attr.constraint_duplicate || attr.__reserved_1)
+ return -EINVAL;
+
if (!attr.exclude_kernel) {
if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
return -EACCES;
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 8354dc81ae64..4025c6034847 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -222,7 +222,10 @@ int perf_trace_add(struct perf_event *p_event, int flags)
void perf_trace_del(struct perf_event *p_event, int flags)
{
struct ftrace_event_call *tp_event = p_event->tp_event;
- hlist_del_rcu(&p_event->hlist_entry);
+ if(!hlist_unhashed(&p_event->hlist_entry))
+ hlist_del_rcu(&p_event->hlist_entry);
+ else
+ return;
tp_event->class->reg(tp_event, TRACE_REG_PERF_DEL, p_event);
}
--
GitLab