From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 21 Jul 2026 13:14:28 +0000 (+0200)
Subject: 6.1-stable patches
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f42c99f1aa885b07bd53c9f1a9d732f677ce2f1d;p=thirdparty%2Fkernel%2Fstable-queue.git

6.1-stable patches

added patches:
	perf-x86-amd-brs-fix-kernel-address-leakage.patch
---

diff --git a/queue-6.1/perf-x86-amd-brs-fix-kernel-address-leakage.patch b/queue-6.1/perf-x86-amd-brs-fix-kernel-address-leakage.patch
new file mode 100644
index 0000000000..ddea6bf1de
--- /dev/null
+++ b/queue-6.1/perf-x86-amd-brs-fix-kernel-address-leakage.patch
@@ -0,0 +1,87 @@
+From 47915e855fb38b42133e31ba917d99565f862154 Mon Sep 17 00:00:00 2001
+From: Sandipan Das <sandipan.das@amd.com>
+Date: Fri, 10 Jul 2026 22:04:49 +0530
+Subject: perf/x86/amd/brs: Fix kernel address leakage
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+commit 47915e855fb38b42133e31ba917d99565f862154 upstream.
+
+A user-only branch stack can contain branches that originate from
+the kernel. As a result, kernel addresses are exposed to user space
+even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
+supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries
+such as SYSRET/interrupt returns for which the branch-from addresses
+are in the kernel.
+
+E.g.
+
+  $ perf record -j any,u -c 4000 -e branch-brs -o - -- \
+        perf bench syscall basic --loop 1000 | \
+        perf script -i - -F brstack|tr ' ' '\n'| \
+        grep -E '0x[89a-f][0-9a-f]{15}'
+
+  ...
+  0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
+  0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
+  0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
+  ...
+
+BRS provides no hardware branch filtering, so privilege level
+filtering is performed entirely in software. However, amd_brs_match_plm()
+only validates the branch-to address against the requested privilege
+levels. For branches from the kernel to user space, the branch-from
+address is left unchecked and is leaked. Extend the software filter to
+also validate the branch-from address, so that any branch record whose
+branch-from address is in the kernel is dropped when
+PERF_SAMPLE_BRANCH_USER is requested.
+
+Fixes: 8910075d61a3 ("perf/x86/amd: Enable branch sampling priv level filtering")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: stable@vger.kernel.org
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com
+Closes: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/
+[sandipan: backport to linux-6.1.y]
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/amd/brs.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/events/amd/brs.c
++++ b/arch/x86/events/amd/brs.c
+@@ -262,13 +262,13 @@ void amd_brs_disable_all(void)
+ 		amd_brs_disable();
+ }
+ 
+-static bool amd_brs_match_plm(struct perf_event *event, u64 to)
++static bool amd_brs_match_plm(struct perf_event *event, u64 from, u64 to)
+ {
+ 	int type = event->attr.branch_sample_type;
+ 	int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV;
+ 	int plm_u = PERF_SAMPLE_BRANCH_USER;
+ 
+-	if (!(type & plm_k) && kernel_ip(to))
++	if (!(type & plm_k) && (kernel_ip(to) || kernel_ip(from)))
+ 		return 0;
+ 
+ 	if (!(type & plm_u) && !kernel_ip(to))
+@@ -341,11 +341,11 @@ void amd_brs_drain(void)
+ 		 */
+ 		to = (u64)(((s64)to << shift) >> shift);
+ 
+-		if (!amd_brs_match_plm(event, to))
+-			continue;
+-
+ 		rdmsrl(brs_from(brs_idx), from);
+ 
++		if (!amd_brs_match_plm(event, from, to))
++			continue;
++
+ 		perf_clear_branch_entry_bitfields(br+nr);
+ 
+ 		br[nr].from = from;
diff --git a/queue-6.1/series b/queue-6.1/series
index 427a5aacd7..adf514dfeb 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -935,3 +935,4 @@ mmc-vub300-defer-reset-until-cmd_mutex-is-unlocked.patch
 mtd-rawnand-fsl_ifc-return-errors-for-failed-page-reads.patch
 mtd-rawnand-lpc32xx_mlc-fail-dma-transfers-on-timeout.patch
 mtd-rawnand-lpc32xx_slc-fail-dma-transfer-on-completion-timeout.patch
+perf-x86-amd-brs-fix-kernel-address-leakage.patch