Vulnerability: arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit.
Vulnerability ID: CVE-2013-2146
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-06-07
File: arch/x86/kernel/cpu/perf_event_intel.c
Commit message: perf/x86: Fix offcore_rsp valid mask for SNB/IVB

The valid mask for both offcore_response_0 and
offcore_response_1 was wrong for SNB/SNB-EP,
IVB/IVB-EP. It was possible to write to
reserved bit and cause a GP fault crashing
the kernel.

This patch fixes the problem by correctly marking the
reserved bits in the valid mask for all the processors
mentioned above.

A distinction between desktop and server parts is introduced
because bits 24-30 are only available on the server parts.

This version of the  patch is just a rebase to perf/urgent tree
and should apply to older kernels as well.

Signed-off-by: Stephane Eranian <eranian@google.com>
Cc: peterz@infradead.org
Cc: jolsa@redhat.com
Cc: gregkh@linuxfoundation.org
Cc: security@kernel.org
Cc: ak@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Commit author: Stephane Eranian

Vulnerable version (before fix):
 static struct event_constraint intel_gen_event_constraints[] __read_mostly = };  static struct extra_reg intel_snb_extra_regs[] __read_mostly = { 	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffffffffull, RSP_0), 	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffffffffull, RSP_1), 	EVENT_EXTRA_END };  __init int intel_pmu_init(void) 		x86_pmu.event_constraints = intel_snb_event_constraints; 		x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints; 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb; 		x86_pmu.extra_regs = intel_snb_extra_regs; 		/* all extra regs are per-cpu when HT is on */ 		x86_pmu.er_flags |= ERF_HAS_RSP_1; 		x86_pmu.er_flags |= ERF_NO_HT_SHARING; __init int intel_pmu_init(void) 		x86_pmu.event_constraints = intel_ivb_event_constraints; 		x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints; 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb; 		x86_pmu.extra_regs = intel_snb_extra_regs; 		/* all extra regs are per-cpu when HT is on */ 		x86_pmu.er_flags |= ERF_HAS_RSP_1; 		x86_pmu.er_flags |= ERF_NO_HT_SHARING;

Fixed version (after fix):
 static struct event_constraint intel_gen_event_constraints[] __read_mostly = };  static struct extra_reg intel_snb_extra_regs[] __read_mostly = { 	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0), 	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1), 	EVENT_EXTRA_END };  static struct extra_reg intel_snbep_extra_regs[] __read_mostly = { 	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0), 	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1), 	EVENT_EXTRA_END };  __init int intel_pmu_init(void) 		x86_pmu.event_constraints = intel_snb_event_constraints; 		x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints; 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb; 		if (boot_cpu_data.x86_model == 45) 			x86_pmu.extra_regs = intel_snbep_extra_regs; 		else 			x86_pmu.extra_regs = intel_snb_extra_regs; 		/* all extra regs are per-cpu when HT is on */ 		x86_pmu.er_flags |= ERF_HAS_RSP_1; 		x86_pmu.er_flags |= ERF_NO_HT_SHARING; __init int intel_pmu_init(void) 		x86_pmu.event_constraints = intel_ivb_event_constraints; 		x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints; 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb; 		if (boot_cpu_data.x86_model == 62) 			x86_pmu.extra_regs = intel_snbep_extra_regs; 		else 			x86_pmu.extra_regs = intel_snb_extra_regs; 		/* all extra regs are per-cpu when HT is on */ 		x86_pmu.er_flags |= ERF_HAS_RSP_1; 		x86_pmu.er_flags |= ERF_NO_HT_SHARING;

Patch:
patch: @@ -153,8 +153,14 @@ static struct event_constraint intel_gen_event_constraints[] __read_mostly =
 };
 
 static struct extra_reg intel_snb_extra_regs[] __read_mostly = {
-	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffffffffull, RSP_0),
-	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffffffffull, RSP_1),
+	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0),
+	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1),
+	EVENT_EXTRA_END
+};
+
+static struct extra_reg intel_snbep_extra_regs[] __read_mostly = {
+	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0),
+	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1),
 	EVENT_EXTRA_END
 };
 
@@ -2097,7 +2103,10 @@ __init int intel_pmu_init(void)
 		x86_pmu.event_constraints = intel_snb_event_constraints;
 		x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
-		x86_pmu.extra_regs = intel_snb_extra_regs;
+		if (boot_cpu_data.x86_model == 45)
+			x86_pmu.extra_regs = intel_snbep_extra_regs;
+		else
+			x86_pmu.extra_regs = intel_snb_extra_regs;
 		/* all extra regs are per-cpu when HT is on */
 		x86_pmu.er_flags |= ERF_HAS_RSP_1;
 		x86_pmu.er_flags |= ERF_NO_HT_SHARING;
@@ -2123,7 +2132,10 @@ __init int intel_pmu_init(void)
 		x86_pmu.event_constraints = intel_ivb_event_constraints;
 		x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints;
 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
-		x86_pmu.extra_regs = intel_snb_extra_regs;
+		if (boot_cpu_data.x86_model == 62)
+			x86_pmu.extra_regs = intel_snbep_extra_regs;
+		else
+			x86_pmu.extra_regs = intel_snb_extra_regs;
 		/* all extra regs are per-cpu when HT is on */
 		x86_pmu.er_flags |= ERF_HAS_RSP_1;
 		x86_pmu.er_flags |= ERF_NO_HT_SHARING;
path: arch/x86/kernel/cpu/perf_event_intel.c