s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()

ev variable is userspace controlled via event->attr.config and used
as an array index after bounds checking, but without speculation
barriers.

Add the missing array_index_nospec() call to prevent speculative
execution.

Cc: stable@vger.kernel.org
Fixes: 212188a596d1 ("[S390] perf: add support for s390x CPU counters")
Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 7aa655664eccb0c1e59b42f2d9f49998ae52b2c5..2076ac22e2c4973dece621246646c5e554298319 100644 (file)
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -15,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/miscdevice.h>
 #include <linux/perf_event.h>
+#include <linux/nospec.h>
 
 #include <asm/cpu_mf.h>
 #include <asm/hwctrset.h>
@@ -768,6 +769,7 @@ static int __hw_perf_event_init(struct perf_event *event, unsigned int type)
                        if (!is_userspace_event(ev)) {
                                if (ev >= ARRAY_SIZE(cpumf_generic_events_user))
                                        return -EOPNOTSUPP;
+                               ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_user));
                                ev = cpumf_generic_events_user[ev];
                        }
                } else if (!attr->exclude_kernel && attr->exclude_user) {
@@ -778,6 +780,7 @@ static int __hw_perf_event_init(struct perf_event *event, unsigned int type)
                        if (!is_userspace_event(ev)) {
                                if (ev >= ARRAY_SIZE(cpumf_generic_events_basic))
                                        return -EOPNOTSUPP;
+                               ev = array_index_nospec(ev, ARRAY_SIZE(cpumf_generic_events_basic));
                                ev = cpumf_generic_events_basic[ev];
                        }
                }