Skip to content

Commit dbc48c8

Browse files
ahunter6Peter Zijlstra
authored andcommitted
perf: Prevent passing zero nr_pages to rb_alloc_aux()
nr_pages is unsigned long but gets passed to rb_alloc_aux() as an int, and is stored as an int. Only power-of-2 values are accepted, so if nr_pages is a 64_bit value, it will be passed to rb_alloc_aux() as zero. That is not ideal because: 1. the value is incorrect 2. rb_alloc_aux() is at risk of misbehaving, although it manages to return -ENOMEM in that case, it is a result of passing zero to get_order() even though the get_order() result is documented to be undefined in that case. Fix by simply validating the maximum supported value in the first place. Use -ENOMEM error code for consistency with the current error code that is returned in that case. Fixes: 45bfb2e ("perf: Add AUX area to ring buffer for raw data streams") Signed-off-by: Adrian Hunter <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Link: https://lore.kernel.org/r/[email protected]
1 parent 3df94a5 commit dbc48c8

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

kernel/events/core.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6496,6 +6496,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
64966496
return -EINVAL;
64976497

64986498
nr_pages = vma_size / PAGE_SIZE;
6499+
if (nr_pages > INT_MAX)
6500+
return -ENOMEM;
64996501

65006502
mutex_lock(&event->mmap_mutex);
65016503
ret = -EINVAL;

0 commit comments

Comments
 (0)