> arch/x86/events/msr.c:178 msr_event_init() warn: potential spectre issue > 'msr' (local cap)
Userspace controls @attr, sanitize cfg (attr->config) before using it to index an array. Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Peter Zijlstra <[email protected]> --- arch/x86/events/msr.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/arch/x86/events/msr.c +++ b/arch/x86/events/msr.c @@ -158,9 +158,6 @@ static int msr_event_init(struct perf_ev if (event->attr.type != event->pmu->type) return -ENOENT; - if (cfg >= PERF_MSR_EVENT_MAX) - return -EINVAL; - /* unsupported modes and filters */ if (event->attr.exclude_user || event->attr.exclude_kernel || @@ -171,6 +168,11 @@ static int msr_event_init(struct perf_ev event->attr.sample_period) /* no sampling */ return -EINVAL; + if (cfg >= PERF_MSR_EVENT_MAX) + return -EINVAL; + + cfg = array_index_nospec(cfg, PERF_MSR_EVENT_MAX); + if (!msr[cfg].attr) return -EINVAL;
