perf/x86/intel/uncore: Validate MMIO address before accessing

An oops will be triggered, if perf tries to access an invalid address
which exceeds the mapped area.

Check the address before the actual access to MMIO sapce of an uncore
unit.

Suggested-by: David Laight <David.Laight@ACULAB.COM>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/1590679169-61823-3-git-send-email-kan.liang@linux.intel.com

diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index b9c28765bf33d17815ccf3ef9a14021370e6037f..cbe32d592aad60d41f76c70ec6970c2267b16cf3 100644 (file)
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -132,6 +132,9 @@ u64 uncore_mmio_read_counter(struct intel_uncore_box *box,
        if (!box->io_addr)
                return 0;
 
+       if (!uncore_mmio_is_valid_offset(box, event->hw.event_base))
+               return 0;
+
        return readq(box->io_addr + event->hw.event_base);
 }
 

diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
index 79ff626b7ea6c576dc8d697f4dac804507e97816..7859ac01f7a5e0da1db9234fbd22c1f9160c9638 100644 (file)
--- a/arch/x86/events/intel/uncore.h
+++ b/arch/x86/events/intel/uncore.h
@@ -197,6 +197,18 @@ static inline bool uncore_pmc_freerunning(int idx)
        return idx == UNCORE_PMC_IDX_FREERUNNING;
 }
 
+static inline bool uncore_mmio_is_valid_offset(struct intel_uncore_box *box,
+                                              unsigned long offset)
+{
+       if (offset < box->pmu->type->mmio_map_size)
+               return true;
+
+       pr_warn_once("perf uncore: Invalid offset 0x%lx exceeds mapped area of %s.\n",
+                    offset, box->pmu->type->name);
+
+       return false;
+}
+
 static inline
 unsigned int uncore_mmio_box_ctl(struct intel_uncore_box *box)
 {

diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index bffb7554f4fbd510a976af8465cedef7b2dcbcae..045c2d2231d221cb11863b062bc1aecba40bce4f 100644 (file)
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -4483,6 +4483,9 @@ static void snr_uncore_mmio_enable_event(struct intel_uncore_box *box,
        if (!box->io_addr)
                return;
 
+       if (!uncore_mmio_is_valid_offset(box, hwc->config_base))
+               return;
+
        writel(hwc->config | SNBEP_PMON_CTL_EN,
               box->io_addr + hwc->config_base);
 }
@@ -4495,6 +4498,9 @@ static void snr_uncore_mmio_disable_event(struct intel_uncore_box *box,
        if (!box->io_addr)
                return;
 
+       if (!uncore_mmio_is_valid_offset(box, hwc->config_base))
+               return;
+
        writel(hwc->config, box->io_addr + hwc->config_base);
 }