3 files changed, 20 insertions, 0 deletions

diff --git a/kernel/events/core.c b/kernel/events/core.c
index fc1c330c6bd6..2d5fe26551f8 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4447,6 +4447,9 @@ static void _free_event(struct perf_event *event)
         if (event->ctx)
                 put_ctx(event->ctx);
 
+        if (event->hw.target)
+                put_task_struct(event->hw.target);
+
         exclusive_event_destroy(event);
         module_put(event->pmu->module);
 
@@ -8397,6 +8400,10 @@ static int perf_kprobe_event_init(struct perf_event *event)
 
         if (event->attr.type != perf_kprobe.type)
                 return -ENOENT;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
+
         /*
          * no branch sampling for probe events
          */
@@ -8434,6 +8441,10 @@ static int perf_uprobe_event_init(struct perf_event *event)
 
         if (event->attr.type != perf_uprobe.type)
                 return -ENOENT;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
+
         /*
          * no branch sampling for probe events
          */
@@ -9955,6 +9966,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
                  * and we cannot use the ctx information because we need the
                  * pmu before we get a ctx.
                  */
+                get_task_struct(task);
                 event->hw.target = task;
         }
 
@@ -10070,6 +10082,8 @@ err_ns:
                 perf_detach_cgroup(event);
         if (event->ns)
                 put_pid_ns(event->ns);
+        if (event->hw.target)
+                put_task_struct(event->hw.target);
         kfree(event);
 
         return ERR_PTR(err);
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 2c416509b834..c79193e598f5 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -252,6 +252,8 @@ int perf_kprobe_init(struct perf_event *p_event, bool is_retprobe)
                 ret = strncpy_from_user(
                         func, u64_to_user_ptr(p_event->attr.kprobe_func),
                         KSYM_NAME_LEN);
+                if (ret == KSYM_NAME_LEN)
+                        ret = -E2BIG;
                 if (ret < 0)
                         goto out;
 
@@ -300,6 +302,8 @@ int perf_uprobe_init(struct perf_event *p_event, bool is_retprobe)
                 return -ENOMEM;
         ret = strncpy_from_user(
                 path, u64_to_user_ptr(p_event->attr.uprobe_path), PATH_MAX);
+        if (ret == PATH_MAX)
+                return -E2BIG;
         if (ret < 0)
                 goto out;
         if (path[0] == '\0') {
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 469ba7ecd14b..34fd0e0ec51d 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -151,6 +151,8 @@ static void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs,
                 return;
 
         ret = strncpy_from_user(dst, src, maxlen);
+        if (ret == maxlen)
+                dst[--ret] = '\0';
 
         if (ret < 0) {  /* Failed to fetch string */
                 ((u8 *)get_rloc_data(dest))[0] = '\0';