Vulnerability: The x86_assign_hw_event function in arch/x86/kernel/cpu/perf_event.c in the Performance Events subsystem in the Linux kernel before 2.6.39 does not properly calculate counter values, which allows local users to cause a denial of service (panic) via the perf program.
Vulnerability ID: CVE-2011-2521
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-05-24
File: arch/x86/kernel/cpu/perf_event.c
Commit message: perf, x86: Fix Intel fixed counters base initialization

The following patch solves the problems introduced by Robert's
commit 41bf498 and reported by Arun Sharma. This commit gets rid
of the base + index notation for reading and writing PMU msrs.

The problem is that for fixed counters, the new calculation for
the base did not take into account the fixed counter indexes,
thus all fixed counters were read/written from fixed counter 0.
Although all fixed counters share the same config MSR, they each
have their own counter register.

Without:

 $ task -e unhalted_core_cycles -e instructions_retired -e baclears noploop 1 noploop for 1 seconds

  242202299 unhalted_core_cycles (0.00% scaling, ena=1000790892, run=1000790892)
 2389685946 instructions_retired (0.00% scaling, ena=1000790892, run=1000790892)
      49473 baclears             (0.00% scaling, ena=1000790892, run=1000790892)

With:

 $ task -e unhalted_core_cycles -e instructions_retired -e baclears noploop 1 noploop for 1 seconds

 2392703238 unhalted_core_cycles (0.00% scaling, ena=1000840809, run=1000840809)
 2389793744 instructions_retired (0.00% scaling, ena=1000840809, run=1000840809)
      47863 baclears             (0.00% scaling, ena=1000840809, run=1000840809)

Signed-off-by: Stephane Eranian <eranian@google.com>
Cc: peterz@infradead.org
Cc: ming.m.lin@intel.com
Cc: robert.richter@amd.com
Cc: asharma@fb.com
Cc: perfmon2-devel@lists.sf.net
LKML-Reference: <20110319172005.GB4978@quad>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Commit author: Stephane Eranian

Vulnerable version (before fix):
 static inline void x86_assign_hw_event(struct perf_event *event, 		hwc->event_base	= 0; 	} else if (hwc->idx >= X86_PMC_IDX_FIXED) { 		hwc->config_base = MSR_ARCH_PERFMON_FIXED_CTR_CTRL; 		hwc->event_base = MSR_ARCH_PERFMON_FIXED_CTR0; 	} else { 		hwc->config_base = x86_pmu_config_addr(hwc->idx); 		hwc->event_base  = x86_pmu_event_addr(hwc->idx);

Fixed version (after fix):
 static inline void x86_assign_hw_event(struct perf_event *event, 		hwc->event_base	= 0; 	} else if (hwc->idx >= X86_PMC_IDX_FIXED) { 		hwc->config_base = MSR_ARCH_PERFMON_FIXED_CTR_CTRL; 		hwc->event_base = MSR_ARCH_PERFMON_FIXED_CTR0 + (hwc->idx - X86_PMC_IDX_FIXED); 	} else { 		hwc->config_base = x86_pmu_config_addr(hwc->idx); 		hwc->event_base  = x86_pmu_event_addr(hwc->idx);

Patch:
patch: @@ -912,7 +912,7 @@ static inline void x86_assign_hw_event(struct perf_event *event,
 		hwc->event_base	= 0;
 	} else if (hwc->idx >= X86_PMC_IDX_FIXED) {
 		hwc->config_base = MSR_ARCH_PERFMON_FIXED_CTR_CTRL;
-		hwc->event_base = MSR_ARCH_PERFMON_FIXED_CTR0;
+		hwc->event_base = MSR_ARCH_PERFMON_FIXED_CTR0 + (hwc->idx - X86_PMC_IDX_FIXED);
 	} else {
 		hwc->config_base = x86_pmu_config_addr(hwc->idx);
 		hwc->event_base  = x86_pmu_event_addr(hwc->idx);
path: arch/x86/kernel/cpu/perf_event.c