linux-kernel - Re: perf: fuzzer crashes immediately on AMD system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 19 Aug 2016 12:56:34 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Vince Weaver <vincent.weaver@...ne.edu>
Cc:     linux-kernel@...r.kernel.org, Borislav Petkov <bp@...e.de>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Huang Rui <ray.huang@....com>, Jacob Shin <jacob.shin@....com>
Subject: Re: perf: fuzzer crashes immediately on AMD system

On Fri, Aug 19, 2016 at 12:01:30PM +0200, Peter Zijlstra wrote:
> On Thu, Aug 18, 2016 at 10:46:31AM -0400, Vince Weaver wrote:
> > On Thu, 18 Aug 2016, Vince Weaver wrote:
> > 
> > > Tried the perf_fuzzer on my A10 fam15h/model13h system with 4.8-rc2 and it
> > > falls over more or less immediately.
> > > 
> > > This maps to variable_test_bit()
> > > 	called by ctx = find_get_context(pmu, task, event);
> > > 		in kernel/events/core.c:9467
> > > 
> > > It happens quickly enough I can probably track down the exact event that 
> > > causes this, if needed.
> > 
> > I have a one line reproducer:
> > 
> > 	perf stat -a -e amd_nb/config=0x37,config1=0x20/ /bin/ls
> 
> OK, cannot reproduce on my fam15h/model1h. I'll go dig through the
> various manuals to see if I can spot the fail.
> 
> Huang could you either prod someone at AMD or do yourself, audit the AMD
> perf code for all the various new models?

So this should obviously help a little in that it will limit the events
you can program into the hardware.

Not at all sure that is what you're hitting though, because I cannot for
the life of me figure how that would end up exploding in generic code.

---
 arch/x86/events/amd/uncore.c | 47 +++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 44 insertions(+), 3 deletions(-)

diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index e6131d4..8c314d7 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -174,8 +174,8 @@ static void amd_uncore_del(struct perf_event *event, int flags)
 
 static int amd_uncore_event_init(struct perf_event *event)
 {
-	struct amd_uncore *uncore;
 	struct hw_perf_event *hwc = &event->hw;
+	struct amd_uncore *uncore;
 
 	if (event->attr.type != event->pmu->type)
 		return -ENOENT;
@@ -215,6 +215,47 @@ static int amd_uncore_event_init(struct perf_event *event)
 	return 0;
 }
 
+static inline unsigned int amd_get_event_code(struct hw_perf_event *hwc)
+{
+	return ((hwc->config >> 24) & 0x0f00) | (hwc->config & 0x00ff);
+}
+
+static int amd_uncore_l2_event_init(struct perf_event *event)
+{
+	int ret = amd_uncore_event_init(event);
+	unsigned int event_code;
+
+	if (ret)
+		return ret;
+
+	/*
+	 * Fam16h L2I performance counter events are in the range: 0x060 - 0x07F
+	 */
+	event_code = amd_get_event_code(&event->hw);
+	if (event_code < 0x060 || event_code > 0x07F)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int amd_uncore_nb_event_init(struct perf_event *event)
+{
+	int ret = amd_uncore_event_init(event);
+	unsigned int event_code;
+
+	if (ret)
+		return ret;
+
+	/*
+	 * AMD NB events will have bits 0x0E0 set.
+	 */
+	event_code = amd_get_event_code(&event->hw);
+	if ((event_code & 0x0E0) != 0x0E0)
+		return -EINVAL;
+
+	return 0;
+}
+
 static ssize_t amd_uncore_attr_show_cpumask(struct device *dev,
 					    struct device_attribute *attr,
 					    char *buf)
@@ -266,7 +307,7 @@ static struct pmu amd_nb_pmu = {
 	.task_ctx_nr	= perf_invalid_context,
 	.attr_groups	= amd_uncore_attr_groups,
 	.name		= "amd_nb",
-	.event_init	= amd_uncore_event_init,
+	.event_init	= amd_uncore_nb_event_init,
 	.add		= amd_uncore_add,
 	.del		= amd_uncore_del,
 	.start		= amd_uncore_start,
@@ -278,7 +319,7 @@ static struct pmu amd_l2_pmu = {
 	.task_ctx_nr	= perf_invalid_context,
 	.attr_groups	= amd_uncore_attr_groups,
 	.name		= "amd_l2",
-	.event_init	= amd_uncore_event_init,
+	.event_init	= amd_uncore_l2_event_init,
 	.add		= amd_uncore_add,
 	.del		= amd_uncore_del,
 	.start		= amd_uncore_start,