Re: [PATCH] perf/arm-cmn: Reject unsupported hardware configurations
From: Mark Rutland <mark.rutland@arm.com>
Date: 2026-01-29 14:23:24
Also in:
linux-perf-users, stable
On Thu, Jan 29, 2026 at 02:11:22PM +0000, Robin Murphy wrote:
quoted hunk ↗ jump to hunk
So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revisions of those which we do know, as although things do frequently change between releases, typically enough remains the same to be somewhat useful for at least some basic bringup checks. However, we also make assumptions of the maximum supported sizes and numbers of things in various places, and there's no guarantee that something new might not be bigger and lead to nasty array overflows. Make sure we only try to run on things that actually match our assumptions and so will not risk memory corruption. Cc: stable@vger.kernel.org Fixes: 7819e05a0dce ("perf/arm-cmn: Revamp model detection") Signed-off-by: Robin Murphy <robin.murphy@arm.com> --- drivers/perf/arm-cmn.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c index 2903e01f951f..24fec53ceccc 100644 --- a/drivers/perf/arm-cmn.c +++ b/drivers/perf/arm-cmn.c@@ -2422,6 +2422,15 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn); dn->portid_bits = xp->portid_bits; dn->deviceid_bits = xp->deviceid_bits; + /* + * Logical IDs are assigned from 0 per node type, so as + * soon as we one bigger than expected, we can assume + * there are more than we can cope with. + */ + if (dn->logid > CMN_MAX_NODES_PER_EVENT) { + dev_err(cmn->dev, "Invalid node number: %d\n", dn->logid); + return -ENODEV;
I think "Invalid" is ambiguous (it can read like we're saying the HW is wrong), and it would be better to say "Unsupported", or something to that effect, e.g. dev_err(cmn->dev, "Node number (%d) larger than supported (%d)\n", dn->logid, CMN_MAX_NODES_PER_EVENT)
quoted hunk ↗ jump to hunk
+ } switch (dn->type) { case CMN_TYPE_DTC:@@ -2499,6 +2508,10 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) cmn->mesh_x = cmn->num_xps; cmn->mesh_y = cmn->num_xps / cmn->mesh_x; + if (max(cmn->mesh_x, cmn->mesh_y) > CMN_MAX_DIMENSION) { + dev_err(cmn->dev, "Invalid mesh size: %dx%d\n", cmn->mesh_x, cmn->mesh_y);
Likewise: dev_err(cmn->dev, "Mesh size (%%dx%d) larger than supported (%d)\n", cmn->mesh_x, cmn->mesh_y, CMN_MAX_DIMENSION);
+ return -ENODEV; + } /* 1x1 config plays havoc with XP event encodings */ if (cmn->num_xps == 1) dev_warn(cmn->dev, "1x1 config not fully supported, translate XP events manually\n");
... or you could align with the wording here. Aside from the specific wording for the messages, this looks god to me. Mark.