Commit 47915e855fb3 for kernel

commit 47915e855fb38b42133e31ba917d99565f862154
Author: Sandipan Das <sandipan.das@amd.com>
Date:   Fri Jul 10 22:04:49 2026 +0530

    perf/x86/amd/brs: Fix kernel address leakage

    A user-only branch stack can contain branches that originate from
    the kernel. As a result, kernel addresses are exposed to user space
    even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
    supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries
    such as SYSRET/interrupt returns for which the branch-from addresses
    are in the kernel.

    E.g.

      $ perf record -j any,u -c 4000 -e branch-brs -o - -- \
            perf bench syscall basic --loop 1000 | \
            perf script -i - -F brstack|tr ' ' '\n'| \
            grep -E '0x[89a-f][0-9a-f]{15}'

      ...
      0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
      0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
      0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
      ...

    BRS provides no hardware branch filtering, so privilege level
    filtering is performed entirely in software. However, amd_brs_match_plm()
    only validates the branch-to address against the requested privilege
    levels. For branches from the kernel to user space, the branch-from
    address is left unchecked and is leaked. Extend the software filter to
    also validate the branch-from address, so that any branch record whose
    branch-from address is in the kernel is dropped when
    PERF_SAMPLE_BRANCH_USER is requested.

    Fixes: 8910075d61a3 ("perf/x86/amd: Enable branch sampling priv level filtering")
    Reported-by: Sashiko <sashiko-bot@kernel.org>
    Signed-off-by: Sandipan Das <sandipan.das@amd.com>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: stable@vger.kernel.org
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Stephane Eranian <eranian@google.com>
    Link: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com
    Closes: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/

diff --git a/arch/x86/events/amd/brs.c b/arch/x86/events/amd/brs.c
index 06f35a6b58a5..dc564688f3d7 100644
--- a/arch/x86/events/amd/brs.c
+++ b/arch/x86/events/amd/brs.c
@@ -259,13 +259,13 @@ void amd_brs_disable_all(void)
 		amd_brs_disable();
 }

-static bool amd_brs_match_plm(struct perf_event *event, u64 to)
+static bool amd_brs_match_plm(struct perf_event *event, u64 from, u64 to)
 {
 	int type = event->attr.branch_sample_type;
 	int plm_k = PERF_SAMPLE_BRANCH_KERNEL | PERF_SAMPLE_BRANCH_HV;
 	int plm_u = PERF_SAMPLE_BRANCH_USER;

-	if (!(type & plm_k) && kernel_ip(to))
+	if (!(type & plm_k) && (kernel_ip(to) || kernel_ip(from)))
 		return 0;

 	if (!(type & plm_u) && !kernel_ip(to))
@@ -338,11 +338,11 @@ void amd_brs_drain(void)
 		 */
 		to = (u64)(((s64)to << shift) >> shift);

-		if (!amd_brs_match_plm(event, to))
-			continue;
-
 		rdmsrq(brs_from(brs_idx), from);

+		if (!amd_brs_match_plm(event, from, to))
+			continue;
+
 		perf_clear_branch_entry_bitfields(br+nr);

 		br[nr].from = from;