History

Merge tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar: - Fix SVM #GP on AMD CPUs that LBR but not BRS (Sandipan Das) - Fix UAF bug in the perf AUX code (Lee Jia Jie) - Fix address leakage in the AMD LBR code (Sandipan Das) - Fix address leakage in the AMD BRS code (Sandipan Das) * tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/amd/brs: Fix kernel address leakage perf/x86/amd/lbr: Fix kernel address leakage perf/aux: Fix page UAF in map_range() perf/x86/amd/core: Avoid enabling BRS from the SVM reload path

Linus Torvalds committed 4 months ago

Commit cab9e332 parents b37fa0d 47915e84 files · +17 −10Browse files

Unified · Split

4 files
  1. arch/x86/events/amd/brs.c +5 −5
  2. arch/x86/events/amd/core.c +8 −4
  3. arch/x86/events/amd/lbr.c +2 −1
  4. kernel/events/core.c +2 −0
arch/x86/events/amd/brs.c+5−5
@@ -259,13 +259,13 @@ void amd_brs_disable_all(void) · 258 unmodified lines
259 amd_brs_disable();259 amd_brs_disable();
260}260}
261 261
262static bool amd_brs_match_plm(struct perf_event *event, u64 to)262static bool amd_brs_match_plm(struct perf_event *event, u64 from, u64 to)
263{263{
264 int type = event->attr.branch_sample_type;264 int type = event->attr.branch_sample_type;
265 int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV;265 int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV;
266 int plm_u = PERF_SAMPLE_BRANCH_USER;266 int plm_u = PERF_SAMPLE_BRANCH_USER;
267 267
268 if (!(type & plm_k) && kernel_ip(to))268 if (!(type & plm_k) && (kernel_ip(to) || kernel_ip(from)))
269 return 0;269 return 0;
270 270
271 if (!(type & plm_u) && !kernel_ip(to))271 if (!(type & plm_u) && !kernel_ip(to))
@@ -338,11 +338,11 @@ void amd_brs_drain(void) · 66 unmodified lines
338 */338 */
339 to = (u64)(((s64)to << shift) >> shift);339 to = (u64)(((s64)to << shift) >> shift);
340 340
341 if (!amd_brs_match_plm(event, to))
342 continue;
343
344 rdmsrq(brs_from(brs_idx), from);341 rdmsrq(brs_from(brs_idx), from);
345 342
343 if (!amd_brs_match_plm(event, from, to))
344 continue;
345
346 perf_clear_branch_entry_bitfields(br+nr);346 perf_clear_branch_entry_bitfields(br+nr);
347 347
348 br[nr].from = from;348 br[nr].from = from;
arch/x86/events/amd/core.c+8−4
@@ -754,13 +754,11 @@ static void amd_pmu_enable_event(struct perf_event *event) · 753 unmodified lines
754 x86_pmu_enable_event(event);754 x86_pmu_enable_event(event);
755}755}
756 756
757static void amd_pmu_enable_all(int added)757static void __amd_pmu_enable_all(void)
758{758{
759 struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);759 struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
760 int idx;760 int idx;
761 761
762 amd_brs_enable_all();
763
764 for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {762 for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) {
765 /* only activate events which are marked as active */763 /* only activate events which are marked as active */
766 if (!test_bit(idx, cpuc->active_mask))764 if (!test_bit(idx, cpuc->active_mask))
@@ -775,6 +773,12 @@ static void amd_pmu_enable_all(int added) · 8 unmodified lines
775 }773 }
776}774}
777 775
776static void amd_pmu_enable_all(int added)
777{
778 amd_brs_enable_all();
779 __amd_pmu_enable_all();
780}
781
778static void amd_pmu_v2_enable_event(struct perf_event *event)782static void amd_pmu_v2_enable_event(struct perf_event *event)
779{783{
780 struct hw_perf_event *hwc = &event->hw;784 struct hw_perf_event *hwc = &event->hw;
@@ -1561,7 +1565,7 @@ static inline void amd_pmu_reload_virt(void) · 780 unmodified lines
1561 * set global enable bits once again1565 * set global enable bits once again
1562 */1566 */
1563 amd_pmu_v2_disable_all();1567 amd_pmu_v2_disable_all();
1564 amd_pmu_enable_all(0);1568 __amd_pmu_enable_all();
1565 amd_pmu_v2_enable_all(0);1569 amd_pmu_v2_enable_all(0);
1566 return;1570 return;
1567 }1571 }
arch/x86/events/amd/lbr.c+2−1
@@ -127,7 +127,8 @@ static void amd_pmu_lbr_filter(void) · 126 unmodified lines
127 }127 }
128 128
129 /* If type does not correspond, then discard */129 /* If type does not correspond, then discard */
130 if (type == X86_BR_NONE || (br_sel & type) != type) {130 if (type == X86_BR_NONE || (br_sel & type) != type ||
131 (!(br_sel & X86_BR_KERNEL) && kernel_ip(cpuc->lbr_entries[i].from))) {
131 cpuc->lbr_entries[i].from = 0; /* mark invalid */132 cpuc->lbr_entries[i].from = 0; /* mark invalid */
132 compress = true;133 compress = true;
133 }134 }
kernel/events/core.c+2−0
@@ -7150,6 +7150,8 @@ static int map_range(struct perf_buffer *rb, struct vm_area_struct *vma) · 7149 unmodified lines
7150 int err = 0;7150 int err = 0;
7151 unsigned long pagenum;7151 unsigned long pagenum;
7152 7152
7153 guard(mutex)(&rb->aux_mutex);
7154
7153 /*7155 /*
7154 * We map this as a VM_PFNMAP VMA.7156 * We map this as a VM_PFNMAP VMA.
7155 *7157 *