Received: by 2002:ac0:a874:0:0:0:0:0 with SMTP id c49csp357172ima; Fri, 15 Mar 2019 04:31:38 -0700 (PDT) X-Google-Smtp-Source: APXvYqwgtxr8XZI29xTb/fynU9WaLezzqhKpSSjLsGtP3Znb+7ryZBCa/dO7HxIRg/wH01FSQ+PH X-Received: by 2002:a17:902:8348:: with SMTP id z8mr3801901pln.151.1552649498573; Fri, 15 Mar 2019 04:31:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1552649498; cv=none; d=google.com; s=arc-20160816; b=KrXIFpgZ3KlgIHaycPpQvkzfRDqQDgktLVUkQ+hlfd6mowH7JtDfNue8RXjbN/gb1L hqnDxtG0tXuYbTAM4xNZSFlVib7cKtBPgYMY2uh3igYXLpoYQlOfJxrjj3CWgX+EYoE+ IWLQnt02jyuhkUZ0RanVHxPQoVfDJ3O3+FIzHjFV5g8fz1B1lIgoV/mLgCBh2PqiECBZ 60NvC+u+C43C8CXiP0fVCvSvEbeaeQZGsPOYqs3nKTmWfmNJRaeWObKZENGbGcfXz6HS kA+qDkWmejipHW/n0Cnd1As7LMnZA3C/pFMwc28YZyMfDxqwZ2u27n2qDqMDVRfiS/W4 qJdQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-disposition :content-transfer-encoding:mime-version:robot-unsubscribe:robot-id :git-commit-id:subject:to:references:in-reply-to:reply-to:cc :message-id:from:date; bh=M5ieejVN/Z6CIJb2B+1VUoEZy6a0q14e2klVYqjxfnQ=; b=TPdQkHtQxGq/23xS1HZ6ZABIt2B8Z3JWQvmeCQ9kiqfxa9auHqJEjjwNzfmVYtyTE/ S/oGmytDshlhjGO+VOf3LC3XpfhgbwJgQCPmbxVNDwye4JxI3eXACyHUprAnEhigLWjc XPcVO2TETgGIX4t8IG+7nogfqNX62K+bUqzLZwGYo48PwfgIm+9gvwLcaNfQsjLInoal o14L2I9+ZxxdJkJFI/5PgZ9gXJQlyJknEyGVW3ZxcnNAsIJyYmVO31+BY5jJuaAAwQ5z UxpuZG54yTMYqjVZ8I1wYOgk1ooFpWvTxhbOv1blszX8onTpwu+zBlLylEUGMCeYnXaj bTag== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id r25si1703129pfd.91.2019.03.15.04.31.23; Fri, 15 Mar 2019 04:31:38 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728219AbfCOL3a (ORCPT + 99 others); Fri, 15 Mar 2019 07:29:30 -0400 Received: from terminus.zytor.com ([198.137.202.136]:41909 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726503AbfCOL3a (ORCPT ); Fri, 15 Mar 2019 07:29:30 -0400 Received: from terminus.zytor.com (localhost [127.0.0.1]) by terminus.zytor.com (8.15.2/8.15.2) with ESMTPS id x2FBT7WM1550573 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Fri, 15 Mar 2019 04:29:08 -0700 Received: (from tipbot@localhost) by terminus.zytor.com (8.15.2/8.15.2/Submit) id x2FBT7r41550570; Fri, 15 Mar 2019 04:29:07 -0700 Date: Fri, 15 Mar 2019 04:29:07 -0700 X-Authentication-Warning: terminus.zytor.com: tipbot set sender to tipbot@zytor.com using -f From: tip-bot for Peter Zijlstra Message-ID: Cc: mingo@kernel.org, linux-kernel@vger.kernel.org, peterz@infradead.org, hpa@zytor.com, tglx@linutronix.de, nelson.dsouza@intel.com, tonyj@suse.com Reply-To: linux-kernel@vger.kernel.org, hpa@zytor.com, nelson.dsouza@intel.com, tglx@linutronix.de, tonyj@suse.com, peterz@infradead.org, mingo@kernel.org In-Reply-To: <20190314130705.441549378@infradead.org> References: <20190314130705.441549378@infradead.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/urgent] perf/x86/intel: Fix memory corruption Git-Commit-ID: ede271b059463731cbd6dffe55ffd70d7dbe8392 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00, T_DATE_IN_FUTURE_96_Q autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on terminus.zytor.com Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: ede271b059463731cbd6dffe55ffd70d7dbe8392 Gitweb: https://git.kernel.org/tip/ede271b059463731cbd6dffe55ffd70d7dbe8392 Author: Peter Zijlstra AuthorDate: Thu, 14 Mar 2019 14:01:14 +0100 Committer: Thomas Gleixner CommitDate: Fri, 15 Mar 2019 12:22:51 +0100 perf/x86/intel: Fix memory corruption Through: validate_event() x86_pmu.get_event_constraints(.idx=-1) tfa_get_event_constraints() dyn_constraint() cpuc->constraint_list[-1] is used, which is an obvious out-of-bound access. In this case, simply skip the TFA constraint code, there is no event constraint with just PMC3, therefore the code will never result in the empty set. Fixes: 400816f60c54 ("perf/x86/intel: Implement support for TSX Force Abort") Reported-by: Tony Jones Reported-by: "DSouza, Nelson" Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Tested-by: Tony Jones Tested-by: "DSouza, Nelson" Cc: eranian@google.com Cc: jolsa@redhat.com Cc: stable@kernel.org Link: https://lkml.kernel.org/r/20190314130705.441549378@infradead.org --- arch/x86/events/intel/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 35102ecdfc8d..92dfeb343a6a 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -3410,7 +3410,7 @@ tfa_get_event_constraints(struct cpu_hw_events *cpuc, int idx, /* * Without TFA we must not use PMC3. */ - if (!allow_tsx_force_abort && test_bit(3, c->idxmsk)) { + if (!allow_tsx_force_abort && test_bit(3, c->idxmsk) && idx >= 0) { c = dyn_constraint(cpuc, c, idx); c->idxmsk64 &= ~(1ULL << 3); c->weight--;