perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=ef9ee4ad38445a30909c48998624861716f2a994
Commit:     ef9ee4ad38445a30909c48998624861716f2a994
Parent:     4411ec1d1993e8dbff2898390e3fed280d88e446
Author:     Peter Zijlstra <peterz at infradead.org>
AuthorDate: Fri Apr 20 14:06:29 2018 +0200
Committer:  Ingo Molnar <mingo at kernel.org>
CommitDate: Sat May 5 08:37:28 2018 +0200

    perf/x86: Fix possible Spectre-v1 indexing for hw_perf_event cache_*
    
    > arch/x86/events/core.c:319 set_ext_hw_attr() warn: potential spectre issue 'hw_cache_event_ids[cache_type]' (local cap)
    > arch/x86/events/core.c:319 set_ext_hw_attr() warn: potential spectre issue 'hw_cache_event_ids' (local cap)
    > arch/x86/events/core.c:328 set_ext_hw_attr() warn: potential spectre issue 'hw_cache_extra_regs[cache_type]' (local cap)
    > arch/x86/events/core.c:328 set_ext_hw_attr() warn: potential spectre issue 'hw_cache_extra_regs' (local cap)
    
    Userspace controls @config which contains 3 (byte) fields used for a 3
    dimensional array deref.
    
    Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz at infradead.org>
    Cc: <stable at kernel.org>
    Cc: Alexander Shishkin <alexander.shishkin at linux.intel.com>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Jiri Olsa <jolsa at redhat.com>
    Cc: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Stephane Eranian <eranian at google.com>
    Cc: Thomas Gleixner <tglx at linutronix.de>
    Cc: Vince Weaver <vincent.weaver at maine.edu>
    Signed-off-by: Ingo Molnar <mingo at kernel.org>
---
 arch/x86/events/core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index a6006e7bb729..b1be0ac51ce0 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -304,17 +304,20 @@ set_ext_hw_attr(struct hw_perf_event *hwc, struct perf_event *event)
 
 	config = attr->config;
 
-	cache_type = (config >>  0) & 0xff;
+	cache_type = (config >> 0) & 0xff;
 	if (cache_type >= PERF_COUNT_HW_CACHE_MAX)
 		return -EINVAL;
+	cache_type = array_index_nospec(cache_type, PERF_COUNT_HW_CACHE_MAX);
 
 	cache_op = (config >>  8) & 0xff;
 	if (cache_op >= PERF_COUNT_HW_CACHE_OP_MAX)
 		return -EINVAL;
+	cache_op = array_index_nospec(cache_op, PERF_COUNT_HW_CACHE_OP_MAX);
 
 	cache_result = (config >> 16) & 0xff;
 	if (cache_result >= PERF_COUNT_HW_CACHE_RESULT_MAX)
 		return -EINVAL;
+	cache_result = array_index_nospec(cache_result, PERF_COUNT_HW_CACHE_RESULT_MAX);
 
 	val = hw_cache_event_ids[cache_type][cache_op][cache_result];