ARM crash in validate event (4.0.0-rc2)

Found by

perf_fuzzer -- Suzuki K. Poulose / Pawel Moll

Severity

crash CVE-2015-8955

First Seen

3.19

Most recently Seen

4.0-rc2

Reproducible

?

Found On

ARM versaile express

Linux-kernel

9 March 2015 -- [PATCH 0/3] [4.0] arm/arm64: Do not group hardware events from different PMUs

Fixed in

4.1

8fff105e13041e49b82f92eef034f363a6b1c071 arm64: perf: reject groups spanning multiple HW PMUs

e429817b401f095ac483fcb02524b01faf45dad6 ARM: perf: reject groups spanning multiple hardware PMUs

Kernel Splat

  1. Bad mode in Synchronous Abort handler detected, code 0x86000006 -- IABT (current EL)
        CPU: 0 PID: 1371 Comm: perf_fuzzer Not tainted 3.19.0+ #249
        Hardware name: V2F-1XV7 Cortex-A53x2 SMM (DT)
        task: ffffffc07c73a280 ti: ffffffc07b0a0000 task.ti: ffffffc07b0a0000
        PC is at 0x0
        LR is at validate_event+0x90/0xa8
        pc : [<0000000000000000>] lr : [] pstate: 00000145
        sp : ffffffc07b0a3ba0
        
        [<          (null)>]           (null)
        [] armpmu_event_init+0x174/0x3cc
        [] perf_try_init_event+0x34/0x70
        [] perf_init_event+0xe0/0x10c
        [] perf_event_alloc+0x288/0x358
        [] SyS_perf_event_open+0x464/0x98c
        Code: bad PC value
    
  2. CPU: 0 PID: 1527 Comm: perf_fuzzer Not tainted 4.0.0-rc2 #57
    Hardware name: ARM-Versatile Express
    task: bd8484c0 ti: be676000 task.ti: be676000
    PC is at 0xbf1bbc90
    LR is at validate_event+0x34/0x5c
    pc : []    lr : [<80016060>]    psr: 00000013
    ...
    [<80016060>] (validate_event) from [<80016198>] (validate_group+0x28/0x90)
    [<80016198>] (validate_group) from [<80016398>] (armpmu_event_init+0x150/0x218)
    [<80016398>] (armpmu_event_init) from [<800882e4>] (perf_try_init_event+0x30/0x48)
    [<800882e4>] (perf_try_init_event) from [<8008f544>] (perf_init_event+0x5c/0xf4)
    [<8008f544>] (perf_init_event) from [<8008f8a8>] (perf_event_alloc+0x2cc/0x35c)
    [<8008f8a8>] (perf_event_alloc) from [<8009015c>] (SyS_perf_event_open+0x498/0xa70)
    [<8009015c>] (SyS_perf_event_open) from [<8000e420>] (ret_fast_syscall+0x0/0x34)
    Code: bf1be000 bf1bb380 802a2664 00000000 (00000002)
    ---[ end trace 01aff0ff00926a0a ]---
    
    

Back to perf_fuzzer bugs found