[Patch v5 01/18] perf/x86: Disable LBR if x86_pmu.lbr_nr exceeds MAX_LBR_ENTRIES

[Dapeng Mi]

Add a sanity check for x86_pmu.lbr_nr. If the hardware reports more LBR
entries than MAX_LBR_ENTRIES, disable LBR to avoid out-of-bounds access
in the cached LBR stack handling path.

Signed-off-by: Dapeng Mi <dapeng1.mi@xxxxxxxxxxxxxxx>
---
 arch/x86/events/amd/lbr.c    | 8 +++++++-
 arch/x86/events/intel/core.c | 7 +++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/arch/x86/events/amd/lbr.c b/arch/x86/events/amd/lbr.c
index a55646fcb846..96c5b5e56053 100644
--- a/arch/x86/events/amd/lbr.c
+++ b/arch/x86/events/amd/lbr.c
@@ -433,7 +433,13 @@ __init int amd_pmu_lbr_init(void)
 	ebx.full = cpuid_ebx(EXT_PERFMON_DEBUG_FEATURES);
 	x86_pmu.lbr_nr = ebx.split.lbr_v2_stack_sz;
 
-	pr_cont("%d-deep LBR, ", x86_pmu.lbr_nr);
+	if (x86_pmu.lbr_nr > MAX_LBR_ENTRIES) {
+		pr_warn("LBR entries %d exceeds max %d, disable LBR.\n",
+			x86_pmu.lbr_nr, MAX_LBR_ENTRIES);
+		x86_pmu.lbr_nr = 0;
+	} else {
+		pr_cont("%d-deep LBR, ", x86_pmu.lbr_nr);
+	}
 
 	return 0;
 }
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 0a34d674df59..10c694db85ea 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -9023,6 +9023,13 @@ __init int intel_pmu_init(void)
 	 */
 	if (x86_pmu.lbr_tos && !check_msr(x86_pmu.lbr_tos, 0x3UL))
 		x86_pmu.lbr_nr = 0;
+
+	if (x86_pmu.lbr_nr > MAX_LBR_ENTRIES) {
+		pr_warn("LBR entries %d exceeds max %d, disable LBR.\n",
+			x86_pmu.lbr_nr, MAX_LBR_ENTRIES);
+		x86_pmu.lbr_nr = 0;
+	}
+
 	for (i = 0; i < x86_pmu.lbr_nr; i++) {
 		if (!(check_msr(x86_pmu.lbr_from + i, 0xffffUL) &&
 		      check_msr(x86_pmu.lbr_to + i, 0xffffUL)))
-- 
2.34.1