linux-kernel - [PATCH 07/19] ARM: imx: Fix MMDC PMU group validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <12766b2e16939ed97df8c410a994c730bede8298.1755096883.git.robin.murphy@arm.com>
Date: Wed, 13 Aug 2025 18:00:59 +0100
From: Robin Murphy <robin.murphy@....com>
To: peterz@...radead.org,
	mingo@...hat.com,
	will@...nel.org,
	mark.rutland@....com,
	acme@...nel.org,
	namhyung@...nel.org,
	alexander.shishkin@...ux.intel.com,
	jolsa@...nel.org,
	irogers@...gle.com,
	adrian.hunter@...el.com,
	kan.liang@...ux.intel.com
Cc: linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linux-alpha@...r.kernel.org,
	linux-snps-arc@...ts.infradead.org,
	linux-arm-kernel@...ts.infradead.org,
	imx@...ts.linux.dev,
	linux-csky@...r.kernel.org,
	loongarch@...ts.linux.dev,
	linux-mips@...r.kernel.org,
	linuxppc-dev@...ts.ozlabs.org,
	linux-s390@...r.kernel.org,
	linux-sh@...r.kernel.org,
	sparclinux@...r.kernel.org,
	linux-pm@...r.kernel.org,
	linux-rockchip@...ts.infradead.org,
	dmaengine@...r.kernel.org,
	linux-fpga@...r.kernel.org,
	amd-gfx@...ts.freedesktop.org,
	dri-devel@...ts.freedesktop.org,
	intel-gfx@...ts.freedesktop.org,
	intel-xe@...ts.freedesktop.org,
	coresight@...ts.linaro.org,
	iommu@...ts.linux.dev,
	linux-amlogic@...ts.infradead.org,
	linux-cxl@...r.kernel.org,
	linux-arm-msm@...r.kernel.org,
	linux-riscv@...ts.infradead.org
Subject: [PATCH 07/19] ARM: imx: Fix MMDC PMU group validation

The group validation here gets the event and its group leader mixed up,
such that if the group leader belongs to a different PMU, the set_bit()
may go wildly out of bounds. While we fix that, also adopt the standard
pattern to avoid racy access the sibling list and drop checks that are
redundant with core code.

Signed-off-by: Robin Murphy <robin.murphy@....com>
---
 arch/arm/mach-imx/mmdc.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c
index 94e4f4a2f73f..f9d432b385a2 100644
--- a/arch/arm/mach-imx/mmdc.c
+++ b/arch/arm/mach-imx/mmdc.c
@@ -238,11 +238,8 @@ static bool mmdc_pmu_group_event_is_valid(struct perf_event *event,
 {
 	int cfg = event->attr.config;
 
-	if (is_software_event(event))
-		return true;
-
 	if (event->pmu != pmu)
-		return false;
+		return true;
 
 	return !test_and_set_bit(cfg, used_counters);
 }
@@ -260,12 +257,12 @@ static bool mmdc_pmu_group_is_valid(struct perf_event *event)
 	struct perf_event *sibling;
 	unsigned long counter_mask = 0;
 
-	set_bit(leader->attr.config, &counter_mask);
+	if (event == leader)
+		return true;
 
-	if (event != leader) {
-		if (!mmdc_pmu_group_event_is_valid(event, pmu, &counter_mask))
-			return false;
-	}
+	set_bit(event->attr.config, &counter_mask);
+	if (!mmdc_pmu_group_event_is_valid(leader, pmu, &counter_mask))
+		return false;
 
 	for_each_sibling_event(sibling, leader) {
 		if (!mmdc_pmu_group_event_is_valid(sibling, pmu, &counter_mask))
-- 
2.39.2.101.g768bb238c484.dirty