From ca614a3aea6e0240e3a08bb7e60e9035e015de2f Mon Sep 17 00:00:00 2001
From: Cyrill Gorcunov <gorcunov@openvz.org>
Date: Sat, 8 May 2010 15:25:54 +0400
Subject: [PATCH] --- yaml --- r: 191307 b: refs/heads/master c:
 c7993165ef0c1d636ca05f4787739f8414584e6d h: refs/heads/master i:   191305:
 3d2f07e1709289b7b8d99f7eac12acb4e4b920b4   191303:
 22d8c2f248e107c4279954facdcadaeee43e60c2 v: v3

---
 [refs]                                    |  2 +-
 trunk/arch/x86/kernel/cpu/perf_event_p4.c | 11 ++++++++++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 4038bf12e0b7..94ca651e6aa3 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 3f51b7119d052827dbb0e40c966acdf2bdc6f47f
+refs/heads/master: c7993165ef0c1d636ca05f4787739f8414584e6d
diff --git a/trunk/arch/x86/kernel/cpu/perf_event_p4.c b/trunk/arch/x86/kernel/cpu/perf_event_p4.c
index b8c2d379eea6..a603930271f3 100644
--- a/trunk/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/trunk/arch/x86/kernel/cpu/perf_event_p4.c
@@ -418,6 +418,7 @@ static int p4_hw_config(struct perf_event *event)
 {
 	int cpu = get_cpu();
 	int rc = 0;
+	unsigned int evnt;
 	u32 escr, cccr;
 
 	/*
@@ -436,6 +437,14 @@ static int p4_hw_config(struct perf_event *event)
 		event->hw.config = p4_set_ht_bit(event->hw.config);
 
 	if (event->attr.type == PERF_TYPE_RAW) {
+
+		/* user data may have out-of-bound event index */
+		evnt = p4_config_unpack_event(event->attr.config);
+		if (evnt >= ARRAY_SIZE(p4_event_bind_map)) {
+			rc = -EINVAL;
+			goto out;
+		}
+
 		/*
 		 * We don't control raw events so it's up to the caller
 		 * to pass sane values (and we don't count the thread number
@@ -451,8 +460,8 @@ static int p4_hw_config(struct perf_event *event)
 	}
 
 	rc = x86_setup_perfctr(event);
+out:
 	put_cpu();
-
 	return rc;
 }