ARM crash in validate event (4.0.0-rc2)

Found by

perf_fuzzer -- Suzuki K. Poulose / Pawel Moll

Severity

crash CVE-2015-8955

First Seen

3.19

Most recently Seen

4.0-rc2

Reproducible

?

Found On

ARM versaile express

Linux-kernel

9 March 2015 -- [PATCH 0/3] [4.0] arm/arm64: Do not group hardware events from different PMUs

Fixed in

4.1

8fff105e13041e49b82f92eef034f363a6b1c071 arm64: perf: reject groups spanning multiple HW PMUs

e429817b401f095ac483fcb02524b01faf45dad6 ARM: perf: reject groups spanning multiple hardware PMUs

Kernel Splat

  1. Bad mode in Synchronous Abort handler detected, code 0x86000006 -- IABT (current EL)
    CPU: 0 PID: 1371 Comm: perf_fuzzer Not tainted 3.19.0+ #249
    Hardware name: V2F-1XV7 Cortex-A53x2 SMM (DT)
    task: ffffffc07c73a280 ti: ffffffc07b0a0000 task.ti: ffffffc07b0a0000
    PC is at 0x0
    LR is at validate_event+0x90/0xa8
    pc : [<0000000000000000>] lr : [] pstate: 00000145
    sp : ffffffc07b0a3ba0
    
    [<          (null)>]           (null)
    [] armpmu_event_init+0x174/0x3cc
    [] perf_try_init_event+0x34/0x70
    [] perf_init_event+0xe0/0x10c
    [] perf_event_alloc+0x288/0x358
    [] SyS_perf_event_open+0x464/0x98c
    Code: bad PC value

  2. CPU: 0 PID: 1527 Comm: perf_fuzzer Not tainted 4.0.0-rc2 #57
Hardware name: ARM-Versatile Express
task: bd8484c0 ti: be676000 task.ti: be676000
PC is at 0xbf1bbc90
LR is at validate_event+0x34/0x5c
pc : []    lr : [<80016060>]    psr: 00000013
...
[<80016060>] (validate_event) from [<80016198>] (validate_group+0x28/0x90)
[<80016198>] (validate_group) from [<80016398>] (armpmu_event_init+0x150/0x218)
[<80016398>] (armpmu_event_init) from [<800882e4>] (perf_try_init_event+0x30/0x48)
[<800882e4>] (perf_try_init_event) from [<8008f544>] (perf_init_event+0x5c/0xf4)
[<8008f544>] (perf_init_event) from [<8008f8a8>] (perf_event_alloc+0x2cc/0x35c)
[<8008f8a8>] (perf_event_alloc) from [<8009015c>] (SyS_perf_event_open+0x498/0xa70)
[<8009015c>] (SyS_perf_event_open) from [<8000e420>] (ret_fast_syscall+0x0/0x34)
Code: bf1be000 bf1bb380 802a2664 00000000 (00000002)
---[ end trace 01aff0ff00926a0a ]---
Back to perf_fuzzer bugs found