[PATCH 2/2] coresight: etm-perf: reject events that exclude both kernel and user space

[Junrui Luo via B4 Relay]

From: Junrui Luo <moonafterrain at outlook.com>

etm_event_init() validates only attr.type, so a cs_etm event can be
opened with both attr.exclude_kernel and attr.exclude_user set. Both
config parsers assign rather than OR the mode bits, so
ETM_MODE_EXCL_KERN is discarded and only ETM_MODE_EXCL_USER survives.
A request to exclude the kernel therefore programs the tracer to
exclude user space and trace the kernel instead.

config->mode has several downstream consumers -- on ETMv4 the TRCVICTLR
ViewInst filter and the FEAT_TRF controls that exist to backstop it, on
ETMv3 the address comparator access type -- and they all derive that
same configuration from it. Since perf_event_open() skips
perf_allow_kernel() when attr.exclude_kernel is set, this potentially
lets an unprivileged user collect an instruction trace of kernel
execution in a per-task event's AUX buffer. The existing guards do not
catch it: etm4_config_trace_mode() warns on the combination but is
reachable only from sysfs, and the early return in
etm_config_trace_mode() can never fire because mode never holds both
bits.

Reject the combination in etm_event_init(), covering both tracer
generations at the single perf entry point.

Fixes: 882d5e112491 ("coresight: etm3x: implementing perf_enable/disable() API")
Reported-by: Yuhao Jiang <danisjiang at gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable at vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain at outlook.com>
---
 drivers/hwtracing/coresight/coresight-etm-perf.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
index af0295eab143..9cc93d48e970 100644
--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -185,6 +185,17 @@ static int etm_event_init(struct perf_event *event)
 		goto out;
 	}
 
+	/*
+	 * Excluding both kernel and user space is not a configuration the
+	 * tracers can express: etm_parse_event_config() and
+	 * etm4_parse_event_config() overwrite ETM_MODE_EXCL_KERN with
+	 * ETM_MODE_EXCL_USER, which ends up tracing the kernel instead.
+	 */
+	if (event->attr.exclude_kernel && event->attr.exclude_user) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	ret = etm_addr_filters_alloc(event);
 	if (ret)
 		goto out;

-- 
2.51.2