)]}'
{
  "commit": "47915e855fb38b42133e31ba917d99565f862154",
  "tree": "1b9ab27b70a86fd9f311b9835aec2016104d6c49",
  "parents": [
    "2a892294b83f541115c94b0bb637f39bef187657"
  ],
  "author": {
    "name": "Sandipan Das",
    "email": "sandipan.das@amd.com",
    "time": "Fri Jul 10 22:04:49 2026 +0530"
  },
  "committer": {
    "name": "Ingo Molnar",
    "email": "mingo@kernel.org",
    "time": "Sat Jul 11 12:19:28 2026 +0200"
  },
  "message": "perf/x86/amd/brs: Fix kernel address leakage\n\nA user-only branch stack can contain branches that originate from\nthe kernel. As a result, kernel addresses are exposed to user space\neven when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors\nsupporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries\nsuch as SYSRET/interrupt returns for which the branch-from addresses\nare in the kernel.\n\nE.g.\n\n  $ perf record -j any,u -c 4000 -e branch-brs -o - -- \\\n        perf bench syscall basic --loop 1000 | \\\n        perf script -i - -F brstack|tr \u0027 \u0027 \u0027\\n\u0027| \\\n        grep -E \u00270x[89a-f][0-9a-f]{15}\u0027\n\n  ...\n  0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-\n  0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-\n  0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-\n  ...\n\nBRS provides no hardware branch filtering, so privilege level\nfiltering is performed entirely in software. However, amd_brs_match_plm()\nonly validates the branch-to address against the requested privilege\nlevels. For branches from the kernel to user space, the branch-from\naddress is left unchecked and is leaked. Extend the software filter to\nalso validate the branch-from address, so that any branch record whose\nbranch-from address is in the kernel is dropped when\nPERF_SAMPLE_BRANCH_USER is requested.\n\nFixes: 8910075d61a3 (\"perf/x86/amd: Enable branch sampling priv level filtering\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Sandipan Das \u003csandipan.das@amd.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nLink: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com\nCloses: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "06f35a6b58a5b228996df99ba3bb62a2bc28cf82",
      "old_mode": 33188,
      "old_path": "arch/x86/events/amd/brs.c",
      "new_id": "dc564688f3d73a094fbb1202d5867e6fdc063ca3",
      "new_mode": 33188,
      "new_path": "arch/x86/events/amd/brs.c"
    }
  ]
}