diff options
| author |   Andy Lutomirski <luto@kernel.org> | 2018-08-29 08:47:18 -0700 |
|---|---|---|
| committer |   Thomas Gleixner <tglx@linutronix.de> | 2018-08-31 17:08:22 +0200 |
| commit | 4012e77a903d114f915fc607d6d2ed54a3d6c9b1 (patch) | |
| tree | aa56d63db999604dd3004855996dca36c293e1cf /arch/x86/events | |
| parent | x86: Allow generating user-space headers without a compiler (diff) | |
| download | wireguard-linux-4012e77a903d114f915fc607d6d2ed54a3d6c9b1.tar.xz wireguard-linux-4012e77a903d114f915fc607d6d2ed54a3d6c9b1.zip | |
x86/nmi: Fix NMI uaccess race against CR3 switching
A NMI can hit in the middle of context switching or in the middle of
switch_mm_irqs_off(). In either case, CR3 might not match current->mm,
which could cause copy_from_user_nmi() and friends to read the wrong
memory.
Fix it by adding a new nmi_uaccess_okay() helper and checking it in
copy_from_user_nmi() and in __copy_from_user_nmi()'s callers.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Rik van Riel <riel@surriel.com>
Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Jann Horn <jannh@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/dd956eba16646fd0b15c3c0741269dfd84452dac.1535557289.git.luto@kernel.org
Diffstat (limited to 'arch/x86/events')
| -rw-r--r-- | arch/x86/events/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index 5f4829f10129..dfb2f7c0d019 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -2465,7 +2465,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs perf_callchain_store(entry, regs->ip); - if (!current->mm) + if (!nmi_uaccess_okay()) return; if (perf_callchain_user32(regs, entry)) |