[PATCH 0/2] coresight: etm-perf: fix resume AUX leak and exclude_kernel bypass

Junrui Luo <[email protected]>
Newsgroups org.kernel.feeds.b4-sent,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID <[email protected]>
Two independent fixes for coresight-etm-perf.c, both tagged for stable.

Patch 1: etm_event_start() shares one error label between the initial
start and the PERF_EF_RESUME path. Taking it on resume skips
fail_end_stop, leaving the AUX transaction from the earlier successful
start outstanding while the event is marked PERF_HES_STOPPED.
etm_event_stop() then returns early, so the AUX handle, the sink, the
remaining path elements and the trace ID are all leaked.

Patch 2: etm_event_init() accepts events with both attr.exclude_kernel
and attr.exclude_user set. Neither config parser ORs the mode bits, so
ETM_MODE_EXCL_KERN is overwritten by ETM_MODE_EXCL_USER and the tracer
is programmed to trace the kernel instead. perf_event_open() skips
perf_allow_kernel() when attr.exclude_kernel is set, so an unprivileged
caller can reach this.

Build tested for arm64. I have no CoreSight hardware, so neither fix has
been exercised at runtime.

Signed-off-by: Junrui Luo <[email protected]>
---
Junrui Luo (2):
      coresight: etm-perf: don't leak the AUX handle on failed resume
      coresight: etm-perf: reject events that exclude both kernel and user space

 drivers/hwtracing/coresight/coresight-etm-perf.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)
---
base-commit: f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
change-id: 20260813-coresight-fixes-7d90d0240dda

Best regards,
-- 
Junrui Luo <[email protected]>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.