Commit 2a892294b83f for kernel

commit 2a892294b83f541115c94b0bb637f39bef187657
Author: Sandipan Das <sandipan.das@amd.com>
Date:   Fri Jul 10 16:15:27 2026 +0530

    perf/x86/amd/lbr: Fix kernel address leakage

    A user-only branch stack can contain branches that originate from
    the kernel. As a result, kernel addresses are exposed to user space
    even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
    supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET
    entries for which the branch-from addresses are in the kernel.

    E.g.

      $ perf record -e cycles -o - -j any,save_type,u -- \
            perf bench syscall basic --loop 1000 | \
            perf script -i - -F brstack|tr ' ' '\n'| \
            grep -E '0x[89a-f][0-9a-f]{15}'

      ...
      0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
      ...

    The reason is that the hardware filter only considers the privilege
    level applicable to the branch target. Extend software filtering to
    also validate the branch-from addresses against br_sel, so that any
    branch record whose branch-from address is in the kernel is dropped
    when PERF_SAMPLE_BRANCH_USER is requested.

    Fixes: f4f925dae741 ("perf/x86/amd/lbr: Add LbrExtV2 hardware branch filter support")
    Reported-by: Ian Rogers <irogers@google.com>
    Signed-off-by: Sandipan Das <sandipan.das@amd.com>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: stable@vger.kernel.org
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: https://patch.msgid.link/a898a29725f6b2f30518354cdc2e432db66c43cf.1783680119.git.sandipan.das@amd.com

diff --git a/arch/x86/events/amd/lbr.c b/arch/x86/events/amd/lbr.c
index 5b437dc8e4ce..9d9c961989d5 100644
--- a/arch/x86/events/amd/lbr.c
+++ b/arch/x86/events/amd/lbr.c
@@ -127,7 +127,8 @@ static void amd_pmu_lbr_filter(void)
 		}

 		/* If type does not correspond, then discard */
-		if (type == X86_BR_NONE || (br_sel & type) != type) {
+		if (type == X86_BR_NONE || (br_sel & type) != type ||
+		    (!(br_sel & X86_BR_KERNEL) && kernel_ip(cpuc->lbr_entries[i].from))) {
 			cpuc->lbr_entries[i].from = 0;	/* mark invalid */
 			compress = true;
 		}