perf/x86/intel: Fix memory corruption
authorPeter Zijlstra <peterz@infradead.org>
Thu, 14 Mar 2019 13:01:14 +0000 (14:01 +0100)
committerThomas Gleixner <tglx@linutronix.de>
Fri, 15 Mar 2019 11:22:51 +0000 (12:22 +0100)
commitede271b059463731cbd6dffe55ffd70d7dbe8392
tree5d1b2014a92505823799984d192a60fa99501dfd
parentf261c4e529dac5608a604d3dd3ae1cd2adf23c89
perf/x86/intel: Fix memory corruption

Through:

  validate_event()
    x86_pmu.get_event_constraints(.idx=-1)
      tfa_get_event_constraints()
        dyn_constraint()

cpuc->constraint_list[-1] is used, which is an obvious out-of-bound access.

In this case, simply skip the TFA constraint code, there is no event
constraint with just PMC3, therefore the code will never result in the
empty set.

Fixes: 400816f60c54 ("perf/x86/intel: Implement support for TSX Force Abort")
Reported-by: Tony Jones <tonyj@suse.com>
Reported-by: "DSouza, Nelson" <nelson.dsouza@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Tony Jones <tonyj@suse.com>
Tested-by: "DSouza, Nelson" <nelson.dsouza@intel.com>
Cc: eranian@google.com
Cc: jolsa@redhat.com
Cc: stable@kernel.org
Link: https://lkml.kernel.org/r/20190314130705.441549378@infradead.org
arch/x86/events/intel/core.c