History

Merge tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar: - Fix SVM #GP on AMD CPUs that LBR but not BRS (Sandipan Das) - Fix UAF bug in the perf AUX code (Lee Jia Jie) - Fix address leakage in the AMD LBR code (Sandipan Das) - Fix address leakage in the AMD BRS code (Sandipan Das) * tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/amd/brs: Fix kernel address leakage perf/x86/amd/lbr: Fix kernel address leakage perf/aux: Fix page UAF in map_range() perf/x86/amd/core: Avoid enabling BRS from the SVM reload path

Linus Torvalds committed 4 months ago

Commit cab9e332 parents b37fa0d 47915e84 files · +17 −10Browse files

Unified · Split

4 files
  1. arch/x86/events/amd/brs.c +5 −5
  2. arch/x86/events/amd/core.c +8 −4
  3. arch/x86/events/amd/lbr.c +2 −1
  4. kernel/events/core.c +2 −0
arch/x86/events/amd/brs.c+5−5
@@ -259,13 +259,13 @@ void amd_brs_disable_all(void) · 258 unmodified lines
259259 amd_brs_disable();
260260 }
261261
262−static bool amd_brs_match_plm(struct perf_event *event, u64 to)
262+static bool amd_brs_match_plm(struct perf_event *event, u64 from, u64 to)
263263 {
264264 int type = event->attr.branch_sample_type;
265265 int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV;
266266 int plm_u = PERF_SAMPLE_BRANCH_USER;
267267
268− if (!(type & plm_k) && kernel_ip(to))
268+ if (!(type & plm_k) && (kernel_ip(to) || kernel_ip(from)))
269269 return 0;
270270
271271 if (!(type & plm_u) && !kernel_ip(to))
@@ -338,11 +338,11 @@ void amd_brs_drain(void) · 66 unmodified lines
338338 */
339339 to = (u64)(((s64)to << shift) >> shift);
340340
341− if (!amd_brs_match_plm(event, to))
342− continue;
343−
344341 rdmsrq(brs_from(brs_idx), from);
345342
343+ if (!amd_brs_match_plm(event, from, to))
344+ continue;
345+
346346 perf_clear_branch_entry_bitfields(br+nr);
347347
348348 br[nr].from = from;
arch/x86/events/amd/core.c+8−4
@@ -754,13 +754,11 @@ static void amd_pmu_enable_event(struct perf_event *event) · 753 unmodified lines
754754 x86_pmu_enable_event(event);
755755 }
756756
757−static void amd_pmu_enable_all(int added)
757+static void __amd_pmu_enable_all(void)
758758 {
759759 struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
760760 int idx;
761761
762− amd_brs_enable_all();
763−
764762 for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
765763 /* only activate events which are marked as active */
766764 if (!test_bit(idx, cpuc->active_mask))
@@ -775,6 +773,12 @@ static void amd_pmu_enable_all(int added) · 8 unmodified lines
775773 }
776774 }
777775
776+static void amd_pmu_enable_all(int added)
777+{
778+ amd_brs_enable_all();
779+ __amd_pmu_enable_all();
780+}
781+
778782 static void amd_pmu_v2_enable_event(struct perf_event *event)
779783 {
780784 struct hw_perf_event *hwc = &event->hw;
@@ -1561,7 +1565,7 @@ static inline void amd_pmu_reload_virt(void) · 780 unmodified lines
15611565 * set global enable bits once again
15621566 */
15631567 amd_pmu_v2_disable_all();
1564− amd_pmu_enable_all(0);
1568+ __amd_pmu_enable_all();
15651569 amd_pmu_v2_enable_all(0);
15661570 return;
15671571 }
arch/x86/events/amd/lbr.c+2−1
@@ -127,7 +127,8 @@ static void amd_pmu_lbr_filter(void) · 126 unmodified lines
127127 }
128128
129129 /* If type does not correspond, then discard */
130− if (type == X86_BR_NONE || (br_sel & type) != type) {
130+ if (type == X86_BR_NONE || (br_sel & type) != type ||
131+ (!(br_sel & X86_BR_KERNEL) && kernel_ip(cpuc->lbr_entries[i].from))) {
131132 cpuc->lbr_entries[i].from = 0; /* mark invalid */
132133 compress = true;
133134 }
kernel/events/core.c+2−0
@@ -7150,6 +7150,8 @@ static int map_range(struct perf_buffer *rb, struct vm_area_struct *vma) · 7149 unmodified lines
71507150 int err = 0;
71517151 unsigned long pagenum;
71527152
7153+ guard(mutex)(&rb->aux_mutex);
7154+
71537155 /*
71547156 * We map this as a VM_PFNMAP VMA.
71557157 *