From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23FAF3E7BC3; Tue, 30 Jun 2026 09:48:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782812897; cv=none; b=NltPceX/ARVi3DPDsAWNAvRn7/Q5tEhOg70Aex0lnazKbOspdXwHBPVmkDscgFOWfBS7xVvSB4iqBKxL2kqzZzhqolt28nxgVqCFVBpwjygCtAUrW0AnpRyjs01Ujrx69WB1LRexWy0aemuXo+g4SNQYqLNJ0ZKh7HSkqpGq6gk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782812897; c=relaxed/simple; bh=v5j+kDCM8omBZea26jJKGbwG7kTV2bg+/MbuzaeftuE=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=J7ajNtiwZQyL0zkKxs2ylVtZbEz0/D4D1hrd/stBKUqrM/wqwUP53wwWnj9WWQwoQ4qTFYUSxRXBR1xgQvIJXdPQQPdinh4t1M7h9IJQbMPA+93iHxd7J7THWcH1Sri6lUnEzq3yqCYWibwZX9yGqHqCMDr38Fmhwmlmeb5EOrU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=KgjXH/Tu; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=+ectjJhw; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="KgjXH/Tu"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="+ectjJhw" Date: Tue, 30 Jun 2026 09:48:12 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1782812894; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Tri0kat5J3jUhtEwqIBtm8bNQhIFAVE5DVnxWOxoOJ8=; b=KgjXH/TuMgJ30opZYYZkYQQSbAOcTRJNabUhOyX49QNxL7eWq5S6KRCtonBVcovap5rvIy 09LoobXB8Fxd/GpqEVHf6FISB1WDK6Rjmqkl7Fn6W0a41i3WVblLv3Kjz7WK72nGQ8CDmq YDnboWj1gSD0jIxp/6rq+99Ah2MPNe+KDvbqE1V1+gqIHd5QqUks5OeL+yXwcqEACoGJr7 X54GpaU1wzXw1xC0Pl/rDOmh6or8xY9Re7/uoug4lglHmO4OygUKp2aTFl/T6lJoSJTCzi 8lg9XjVMzvhLuHUQhJL9Zq3n/2tVl7FvYAawqAShEhABVUp/6TnmEHfFBFE+Jw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1782812894; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Tri0kat5J3jUhtEwqIBtm8bNQhIFAVE5DVnxWOxoOJ8=; b=+ectjJhwlRU6+fmKNDaOyr9AzOjkNaoxPApiBlG9HE4DFzKyC9We+lY3NOMgExAwO6ovMw 9Dzu//9nSPCNA+Aw== From: "tip-bot2 for Dapeng Mi" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: perf/core] perf/core: Fix kernel register info leak via hardware skid Cc: Dapeng Mi , "Peter Zijlstra (Intel)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260616044654.3468742-8-dapeng1.mi@linux.intel.com> References: <20260616044654.3468742-8-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178281289244.3843924.4977233288957378014.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the perf/core branch of tip: Commit-ID: 166f10836a653dfa280d4335603b52f685b8b1ef Gitweb: https://git.kernel.org/tip/166f10836a653dfa280d4335603b52f685b= 8b1ef Author: Dapeng Mi AuthorDate: Tue, 16 Jun 2026 12:46:53 +08:00 Committer: Peter Zijlstra CommitterDate: Tue, 30 Jun 2026 11:46:07 +02:00 perf/core: Fix kernel register info leak via hardware skid An unprivileged hardware perf event using exclude_kernel=3D1 can leak kernel register data to user space via PERF_SAMPLE_REGS_INTR or PERF_SAMPLE_IP. Due to hardware skid, a PMI may trigger after the CPU has already entered kernel space (Ring 0), bypassing the perf_allow_kernel() privilege barrier. This security vulnerability is severely exacerbated by upcoming support for SIMD register sampling via XSAVES, which could expose sensitive kernel FPU states (such as active cryptographic keys). Fix this by ensuring that sampled register data is dropped if the event's exclude_kernel attribute is set but the PMI catches the CPU in kernel mode. Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20260529085613.CCAFB1F00893@smtp.kernel.org/ Link: https://patch.msgid.link/20260616044654.3468742-8-dapeng1.mi@linux.inte= l.com --- kernel/events/core.c | 37 ++++++++++++++++++++++++++++++------- 1 file changed, 30 insertions(+), 7 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 954c36e..dd3bd9c 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -7791,10 +7791,20 @@ unsigned long perf_misc_flags(struct perf_event *even= t, unsigned long perf_instruction_pointer(struct perf_event *event, struct pt_regs *regs) { - if (should_sample_guest(event)) - return perf_guest_get_ip(); + /* + * Hardware skid can lead to a scenario where a PMI is + * delivered after the CPU has already entered kernel mode. + * In that case, user-space sampling must not expose kernel + * register state. + */ + if (should_sample_guest(event)) { + return event->attr.exclude_kernel && + !(perf_guest_state() & PERF_GUEST_USER) ? + 0 : perf_guest_get_ip(); + } =20 - return perf_arch_instruction_pointer(regs); + return event->attr.exclude_kernel && !user_mode(regs) ? + 0 : perf_arch_instruction_pointer(regs); } =20 static void @@ -7828,10 +7838,22 @@ static void perf_sample_regs_user(struct perf_regs *r= egs_user, } =20 static void perf_sample_regs_intr(struct perf_regs *regs_intr, - struct pt_regs *regs) + struct pt_regs *regs, + bool exclude_kernel) { - regs_intr->regs =3D regs; - regs_intr->abi =3D perf_reg_abi(current); + /* + * Hardware skid can lead to a scenario where a PMI is + * delivered after the CPU has already entered kernel mode. + * In that case, user-space sampling must not expose kernel + * register state. + */ + if (exclude_kernel && !user_mode(regs)) { + regs_intr->abi =3D PERF_SAMPLE_REGS_ABI_NONE; + regs_intr->regs =3D NULL; + } else { + regs_intr->regs =3D regs; + regs_intr->abi =3D perf_reg_abi(current); + } } =20 =20 @@ -8722,7 +8744,8 @@ void perf_prepare_sample(struct perf_sample_data *data, /* regs dump ABI info */ int size =3D sizeof(u64); =20 - perf_sample_regs_intr(&data->regs_intr, regs); + perf_sample_regs_intr(&data->regs_intr, regs, + event->attr.exclude_kernel); =20 if (data->regs_intr.regs) { u64 mask =3D event->attr.sample_regs_intr;