Messages in this thread Patch in this message | | | Date | Fri, 20 Apr 2018 15:14:11 +0200 | From | Peter Zijlstra <> | Subject | [PATCH 4/7] perf,x86/msr: Fix possible Spectre-v1 for msr |
| |
> arch/x86/events/msr.c:178 msr_event_init() warn: potential spectre issue 'msr' (local cap)
Userspace controls @attr, sanitize cfg (attr->config) before using it to index an array.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Peter Zijlstra <peterz@infradead.org> --- arch/x86/events/msr.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
--- a/arch/x86/events/msr.c +++ b/arch/x86/events/msr.c @@ -158,9 +158,6 @@ static int msr_event_init(struct perf_ev if (event->attr.type != event->pmu->type) return -ENOENT; - if (cfg >= PERF_MSR_EVENT_MAX) - return -EINVAL; - /* unsupported modes and filters */ if (event->attr.exclude_user || event->attr.exclude_kernel || @@ -171,6 +168,11 @@ static int msr_event_init(struct perf_ev event->attr.sample_period) /* no sampling */ return -EINVAL; + if (cfg >= PERF_MSR_EVENT_MAX) + return -EINVAL; + + cfg = array_index_nospec(cfg, PERF_MSR_EVENT_MAX); + if (!msr[cfg].attr) return -EINVAL;
| |