Re: [PATCH v7 3/3] perf/core: Fill branch entries with a single assignment

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The BPF branch snapshot helpers (__intel_pmu_snapshot_branch_stack and amd_pmu_v2_snapshot_branch_stack) unconditionally copy stale branch records (LBRs) to BPF buffers, leading to cross-context information leaks.
--

--- Patch [3]: [PATCH v7 3/3] perf/core: Fill branch entries with a single assignment ---
commit f67f9ecd08216c6081d3d24e81906c232c6917fe
Author: Puranjay Mohan <puranjay@kernel.org>

perf/core: Fill branch entries with a single assignment

This commit replaces the field-by-field initialization of perf_branch_entry
with a single structure assignment. This automatically zeroes out any unnamed
fields, removing the need to manually keep perf_clear_branch_entry_bitfields
in sync with the structure definition.

> diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
> index cae2e02fe6cc4..539e9feffa356 100644
> --- a/arch/x86/events/intel/lbr.c
> +++ b/arch/x86/events/intel/lbr.c
[ ... ]
> @@ -847,14 +847,15 @@ void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
>  		if (abort && x86_pmu.lbr_double_abort && out > 0)
>  			out--;
>  
> -		perf_clear_branch_entry_bitfields(br+out);
> -		br[out].from	 = from;
> -		br[out].to	 = to;
> -		br[out].mispred	 = mis;
> -		br[out].predicted = pred;
> -		br[out].in_tx	 = in_tx;
> -		br[out].abort	 = abort;
> -		br[out].cycles	 = cycles;
> +		br[out] = (struct perf_branch_entry){
> +			.from		= from,
> +			.to		= to,
> +			.mispred	= mis,
> +			.predicted	= pred,
> +			.in_tx		= in_tx,
> +			.abort		= abort,
> +			.cycles		= cycles,
> +		};
>  		out++;
>  	}
>  	cpuc->lbr_stack.nr = out;

[Severity: High]
This is a pre-existing issue, but while reviewing how these branch entries
are populated and tracked by cpuc->lbr_stack.nr, I noticed a potential
information leak in the BPF branch snapshot helpers.

Does __intel_pmu_snapshot_branch_stack() unconditionally copy stale
branch records to the BPF buffer?

arch/x86/events/intel/core.c:__intel_pmu_snapshot_branch_stack() {
    ...
    cnt = min_t(unsigned int, cnt, x86_pmu.lbr_nr);
    memcpy(entries, cpuc->lbr_entries, sizeof(struct perf_branch_entry) * cnt);
    ...
}

When the number of valid LBR entries (cpuc->lbr_stack.nr) is less than the
hardware capacity (x86_pmu.lbr_nr), this memcpy appears to copy the trailing
unwritten entries from cpuc->lbr_entries. This condition can happen routinely
in call-stack mode with shallow stacks, or when Intel's double-abort erratum
skips an entry (as seen just above in this diff).

The AMD implementation seems to have the exact same logic error:

arch/x86/events/amd/core.c:amd_pmu_v2_snapshot_branch_stack() {
    ...
    cnt = min(cnt, x86_pmu.lbr_nr);
    memcpy(entries, cpuc->lbr_entries, sizeof(struct perf_branch_entry) * cnt);
    ...
}

Could this allow a BPF tracing program to read stale hardware branch records
left over from previously executed contexts, leaking execution history from
other tasks or the kernel?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260810133540.1947118-1-puranjay@kernel.org?part=3