Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d06bafc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'arm64-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64 

Pull arm64 perf fixes from Catalin Marinas:
 "Perf backend fixes for arm64 where the user can cause kernel panic
  (discovered with Vince's fuzzing tool)"

* tag 'arm64-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64:
  arm64: perf: fix event validation for software group leaders
  arm64: perf: fix array out of bounds access in armpmu_map_hw_event()
parents 69bbe136 ee7538a0

arch/arm64/kernel/perf_event.c

+9 −1
Original line number Diff line number Diff line
@@ -107,7 +107,12 @@ armpmu_map_cache_event(const unsigned (*cache_map) 
static int

armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)

{

	int mapping = (*event_map)[config];

	int mapping;



	if (config >= PERF_COUNT_HW_MAX)

		return -EINVAL;



	mapping = (*event_map)[config];

	return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;

}
@@ -317,6 +322,9 @@ validate_event(struct pmu_hw_events *hw_events, 
	struct hw_perf_event fake_event = event->hw;

	struct pmu *leader_pmu = event->group_leader->pmu;



	if (is_software_event(event))

		return 1;



	if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)

		return 1;