CVE-2023-52835: perf/core: Bail out early if the request AUX area is out of bound

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Bail out early if the request AUX area is out of bound

When perf-record with a large AUX area, e.g 4GB, it fails with:

#perf record -C 0 -m ,4G -e armspe0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)

and it reveals a WARNING with allocpages():

------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/pagealloc.c:5568 allocpages+0x1ec/0x248 Call trace: allocpages+0x1ec/0x248 kmalloclargenode+0xc0/0x1f8 kmallocnode+0x134/0x1e8 rballocaux+0xe0/0x298 perfmmap+0x440/0x660 mmapregion+0x308/0x8a8 dommap+0x3c0/0x528 vmmmappgoff+0xf4/0x1b8 ksysmmappgoff+0x18c/0x218 arm64sysmmap+0x38/0x58 invokesyscall+0x50/0x128 el0svccommon.constprop.0+0x58/0x188 doel0svc+0x34/0x50 el0svc+0x34/0x108 el0t64synchandler+0xb8/0xc0 el0t64sync+0x1a4/0x1a8

'rb->auxpages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAXORDER. If the size of pointer array crosses the limitation set by MAXORDER, it reveals a WARNING.

So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.:

#perf record -C 0 -m ,4G -e armspe0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)

— NVD

Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.

— IBM