perf events fixes
Subsystems (2)
Linus,
Please pull the latest perf/urgent Git tree from:
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git perf-urgent-2026-07-11
for you to fetch changes up to 47915e855fb38b42133e31ba917d99565f862154:
Misc perf events fixes:
- Fix SVM #GP on AMD CPUs that LBR but not BRS
(Sandipan Das)
- Fix UAF bug in the perf AUX code (Lee Jia Jie)
- Fix address leakage in the AMD LBR code
(Sandipan Das)
- Fix address leakage in the AMD BRS code
(Sandipan Das)
Thanks,
Ingo
------------------>
Lee Jia Jie (1):
perf/aux: Fix page UAF in map_range()
Sandipan Das (3):
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path perf/x86/amd/lbr: Fix kernel address leakage perf/x86/amd/brs: Fix kernel address leakage
arch/x86/events/amd/brs.c | 10 +++++----- arch/x86/events/amd/core.c | 12 ++++++++---- arch/x86/events/amd/lbr.c | 3 ++- kernel/events/core.c | 2 ++ 4 files changed, 17 insertions(+), 10 deletions(-)
arch/x86/events/amd/brs.c +5 -5
@@ -259,13 +259,13 @@ void amd_brs_disable_all(void)amd_brs_disable (); } -static bool amd_brs_match_plm (struct perf_event *event,u64 to) +static bool amd_brs_match_plm (struct perf_event *event,u64 from,u64 to) {int type = event->attr.branch_sample_type;int plm_k =PERF_SAMPLE_BRANCH_KERNEL |PERF_SAMPLE_BRANCH_HV ;int plm_u =PERF_SAMPLE_BRANCH_USER ; -if (!(type & plm_k) &&kernel_ip (to)) +if (!(type & plm_k) && (kernel_ip (to) ||kernel_ip (from)))return 0 ;if (!(type & plm_u) && !kernel_ip (to))
@@ -338,11 +338,11 @@ void amd_brs_drain(void)*/ to = (u64)(((s64 )to << shift) >> shift); -if (!amd_brs_match_plm (event, to)) -continue ; -rdmsrq (brs_from (brs_idx), from); +if (!amd_brs_match_plm (event, from, to)) +continue ; +perf_clear_branch_entry_bitfields (br+nr); br[nr].from = from;
arch/x86/events/amd/core.c +8 -4
@@ -754,13 +754,11 @@ static void amd_pmu_enable_event(struct perf_event *event)x86_pmu_enable_event (event); } -static void amd_pmu_enable_all (int added) +static void __amd_pmu_enable_all (void ) {struct cpu_hw_events *cpuc =this_cpu_ptr (&cpu_hw_events);int idx; -amd_brs_enable_all (); -for_each_set_bit (idx, x86_pmu.cntr_mask,X86_PMC_IDX_MAX ) {/* only activate events which are marked as active */ if (!test_bit (idx, cpuc->active_mask))
@@ -775,6 +773,12 @@ static void amd_pmu_enable_all(int added) } } +static void amd_pmu_enable_all (int added) +{ +amd_brs_enable_all (); +__amd_pmu_enable_all (); +} +static void amd_pmu_v2_enable_event (struct perf_event *event) {struct hw_perf_event *hwc = &event->hw;
@@ -1561,7 +1565,7 @@ static inline void amd_pmu_reload_virt(void)* set global enable bits once again */ amd_pmu_v2_disable_all (); -amd_pmu_enable_all (0 ); +__amd_pmu_enable_all ();amd_pmu_v2_enable_all (0 );return ; }
arch/x86/events/amd/lbr.c +2 -1
@@ -127,7 +127,8 @@ static void amd_pmu_lbr_filter(void) }/* If type does not correspond, then discard */ -if (type ==X86_BR_NONE || (br_sel & type) != type) { +if (type ==X86_BR_NONE || (br_sel & type) != type || + (!(br_sel &X86_BR_KERNEL ) &&kernel_ip (cpuc->lbr_entries[i].from))) { cpuc->lbr_entries[i].from =0 ;/* mark invalid */ compress = true; }
kernel/events/core.c +2 -0
@@ -7150,6 +7150,8 @@ static int map_range(struct perf_buffer *rb, struct vm_area_struct *vma)int err =0 ;unsigned long pagenum; +guard (mutex)(&rb->aux_mutex); +/* * We map this as a VM_PFNMAP VMA. *
The pull request you sent on Sat, 11 Jul 2026 13:38:01 +0200:
The pull request you sent on Sat, 11 Jul 2026 13:38:01 +0200:
Quoted 1 line
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.gitperf-urgent-2026-07-11
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/cab9e339cfbc1a4e075e53e281dfb00391e1a6bb
Thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/prtracker.html