| From: Peter Zijlstra <peterz@infradead.org> |
| Date: Fri, 20 Apr 2018 14:08:58 +0200 |
| Subject: perf/x86: Fix possible Spectre-v1 indexing for x86_pmu::event_map() |
| |
| commit 46b1b577229a091b137831becaa0fae8690ee15a upstream. |
| |
| > arch/x86/events/intel/cstate.c:307 cstate_pmu_event_init() warn: potential spectre issue 'pkg_msr' (local cap) |
| > arch/x86/events/intel/core.c:337 intel_pmu_event_map() warn: potential spectre issue 'intel_perfmon_event_map' |
| > arch/x86/events/intel/knc.c:122 knc_pmu_event_map() warn: potential spectre issue 'knc_perfmon_event_map' |
| > arch/x86/events/intel/p4.c:722 p4_pmu_event_map() warn: potential spectre issue 'p4_general_events' |
| > arch/x86/events/intel/p6.c:116 p6_pmu_event_map() warn: potential spectre issue 'p6_perfmon_event_map' |
| > arch/x86/events/amd/core.c:132 amd_pmu_event_map() warn: potential spectre issue 'amd_perfmon_event_map' |
| |
| Userspace controls @attr, sanitize @attr->config before passing it on |
| to x86_pmu::event_map(). |
| |
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> |
| Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> |
| Cc: Arnaldo Carvalho de Melo <acme@redhat.com> |
| Cc: Jiri Olsa <jolsa@redhat.com> |
| Cc: Linus Torvalds <torvalds@linux-foundation.org> |
| Cc: Peter Zijlstra <peterz@infradead.org> |
| Cc: Stephane Eranian <eranian@google.com> |
| Cc: Thomas Gleixner <tglx@linutronix.de> |
| Cc: Vince Weaver <vincent.weaver@maine.edu> |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| [bwh: Backported to 3.16: adjust filename] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| arch/x86/kernel/cpu/perf_event.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/arch/x86/kernel/cpu/perf_event.c |
| +++ b/arch/x86/kernel/cpu/perf_event.c |
| @@ -25,6 +25,7 @@ |
| #include <linux/cpu.h> |
| #include <linux/bitops.h> |
| #include <linux/device.h> |
| +#include <linux/nospec.h> |
| |
| #include <asm/apic.h> |
| #include <asm/stacktrace.h> |
| @@ -319,6 +320,8 @@ int x86_setup_perfctr(struct perf_event |
| if (attr->config >= x86_pmu.max_events) |
| return -EINVAL; |
| |
| + attr->config = array_index_nospec((unsigned long)attr->config, x86_pmu.max_events); |
| + |
| /* |
| * The generic map: |
| */ |
