github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Misc perf events fixes:

Browse Source 
- Fix SVM #GP on AMD CPUs that LBR but not BRS
    (Sandipan Das)
 
  - Fix UAF bug in the perf AUX code (Lee Jia Jie)
 
  - Fix address leakage in the AMD LBR code
    (Sandipan Das)
 
  - Fix address leakage in the AMD BRS code
    (Sandipan Das)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpSKr0RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hsTA//Vm7AzLa5iDBu12fINDMC/62kDTfLu5OD
 WvIeygRJYOkx/P1FxAigJHXnA6/dqAoLusbgaLG0pzoNr0cI+MREuvuIYP0xDb6V
 yTQe2mvvjBoQ+5XDRnt2D19Pgo9PAIN62zk3UJSTvtkJ7u0P+POGxKSMq6Kbg3sO
 DcYaAXrs+JnFeKjAahXnX4USB15uhkq1BKDFfB+PJUaaAoysueu2/ceGRtXiN9eW
 X/v59IhCYJ5sfOOJ72CCkLsAdXKjyHFnhaYoslu5V9nfUxhLzbEGGWTIdsVLazsp
 t6F16c/dsxrMpG24TLfbucIDvV4Qt+oZrfVqHdLXvfunRwuCQt+ajXNBVi1krgKQ
 mjFaXJ15NGE9xrs+Id+m0rBFMVvKqvEh0sw+1URItsmZKB4RK7IA6ktlnod5J9XF
 nYPNr0OqYw/Nd8MAEERvlOmqB0GQ/XGxRF8AsYo+IY7VRD/hrC+wRvsCDkZnOnrf
 Jc4zJVW/+kXI0PzA1o7qolCGR5t9Ed8VDGK7dxwMF7lWshidgpFtBOm6MW9yuVgc
 DjemSRObXRDqrspF/VFn9u7xJ/RNiAi+tARDmKQRPKeu3dX0QaYVt5umSwjmas39
 KVGP3vhVoPFyeuis1VJxdgDXyssaruXglV/AJo6yCZZDK1UgMzRo726ZUi2c5OZL
 43uBh4RKUi8=
 =OpxC
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Fix SVM #GP on AMD CPUs that LBR but not BRS (Sandipan Das)

 - Fix UAF bug in the perf AUX code (Lee Jia Jie)

 - Fix address leakage in the AMD LBR code (Sandipan Das)

 - Fix address leakage in the AMD BRS code (Sandipan Das)

* tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/amd/brs: Fix kernel address leakage
  perf/x86/amd/lbr: Fix kernel address leakage
  perf/aux: Fix page UAF in map_range()
  perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
This commit is contained in:
Linus Torvalds 2026-07-11 10:11:45 -07:00
commit cab9e339cf
4 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
arch/x86/events/amd/brs.c
View File

@ -259,13 +259,13 @@ void amd_brs_disable_all(void)
amd_brs_disable();
}
static bool amd_brs_match_plm(struct perf_event *event, u64 to)
static bool amd_brs_match_plm(struct perf_event *event, u64 from, u64 to)
{
int type = event->attr.branch_sample_type;
int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV;
int plm_u = PERF_SAMPLE_BRANCH_USER;
if (!(type & plm_k) && kernel_ip(to))
if (!(type & plm_k) && (kernel_ip(to) || kernel_ip(from)))
return 0;
if (!(type & plm_u) && !kernel_ip(to))
@ -338,11 +338,11 @@ void amd_brs_drain(void)
*/
to = (u64)(((s64)to << shift) >> shift);
if (!amd_brs_match_plm(event, to))
continue;
rdmsrq(brs_from(brs_idx), from);
if (!amd_brs_match_plm(event, from, to))
continue;
perf_clear_branch_entry_bitfields(br+nr);
br[nr].from = from;

12
arch/x86/events/amd/core.c
View File

@ -754,13 +754,11 @@ static void amd_pmu_enable_event(struct perf_event *event)
x86_pmu_enable_event(event);
}
static void amd_pmu_enable_all(int added)
static void __amd_pmu_enable_all(void)
{
struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
int idx;
amd_brs_enable_all();
for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
/* only activate events which are marked as active */
if (!test_bit(idx, cpuc->active_mask))
@ -775,6 +773,12 @@ static void amd_pmu_enable_all(int added)
}
}
static void amd_pmu_enable_all(int added)
{
amd_brs_enable_all();
__amd_pmu_enable_all();
}
static void amd_pmu_v2_enable_event(struct perf_event *event)
{
struct hw_perf_event *hwc = &event->hw;
@ -1561,7 +1565,7 @@ static inline void amd_pmu_reload_virt(void)
* set global enable bits once again
*/
amd_pmu_v2_disable_all();
amd_pmu_enable_all(0);
__amd_pmu_enable_all();
amd_pmu_v2_enable_all(0);
return;
}

3
arch/x86/events/amd/lbr.c
View File

@ -127,7 +127,8 @@ static void amd_pmu_lbr_filter(void)
}
/* If type does not correspond, then discard */
if (type == X86_BR_NONE || (br_sel & type) != type) {
if (type == X86_BR_NONE || (br_sel & type) != type ||
(!(br_sel & X86_BR_KERNEL) && kernel_ip(cpuc->lbr_entries[i].from))) {
cpuc->lbr_entries[i].from = 0; /* mark invalid */
compress = true;
}

2
kernel/events/core.c
View File

@ -7150,6 +7150,8 @@ static int map_range(struct perf_buffer *rb, struct vm_area_struct *vma)
int err = 0;
unsigned long pagenum;
guard(mutex)(&rb->aux_mutex);
/*
* We map this as a VM_PFNMAP VMA.
*