diff options
| author | Srinivasarao P <spathi@codeaurora.org> | 2016-03-01 12:16:03 +0530 |
|---|---|---|
| committer | Jeevan Shriram <jshriram@codeaurora.org> | 2016-05-18 13:39:58 -0700 |
| commit | 06ae01888eec7d95d65fc0e55daeea972d292977 (patch) | |
| tree | 93a42c9759a84d842edbf44a18cb510b45275071 /kernel | |
| parent | fe77e532290ee3fdcbfd9d15db28c17eab44c93b (diff) | |
perf: duplicate deletion of perf event
a malicious app can open a perf event with constraint_duplicate
bit set, disable the event, and close the fd. On closing the fd,
the perf_release() modification causes the kernel to clean up
the event as if it still were enabled, leading to the event
being removed from a list twice.
CRs-Fixed: 977563
Change-Id: I5fbec3722407d2f3d0ff0d9f7097c5889e31fd62
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/events/core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/kernel/events/core.c b/kernel/events/core.c index 01686c17b480..1cb22d44ccbb 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -8322,6 +8322,9 @@ SYSCALL_DEFINE5(perf_event_open, if (err) return err; + if (attr.constraint_duplicate || attr.__reserved_1) + return -EINVAL; + if (!attr.exclude_kernel) { if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN)) return -EACCES; |