linux-kernel - Re: perf: fuzzer causes crash in new XMM code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.21.1905231226190.4041@macbook-air>
Date:   Thu, 23 May 2019 12:30:56 -0400 (EDT)
From:   Vince Weaver <vincent.weaver@...ne.edu>
To:     "Liang, Kan" <kan.liang@...ux.intel.com>
cc:     Andi Kleen <ak@...ux.intel.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Arnaldo Carvalho de Melo <acme@...hat.com>,
        Jiri Olsa <jolsa@...hat.com>,
        Stephane Eranian <eranian@...gle.com>,
        Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: perf: fuzzer causes crash in new XMM code

On Wed, 22 May 2019, Liang, Kan wrote:

> XMM registers can only collected by hardware PEBS events. We should disable it
> for all software/probe events.
> 
> Could you please try the patch as below?

I tested the patch (it was whitespace damaged for some reason, not 
sure if that was on my end though).

Running a few hours here, it hasn't crashed, but it did produce this 
warning which appears to map to:
	if (WARN_ON_ONCE(idx >= ARRAY_SIZE(pt_regs_offset)))
		return 0;

[ 5552.352046] WARNING: CPU: 1 PID: 11469 at arch/x86/kernel/perf_regs.c:76 perf_reg_value+0x45/0x50
[ 5552.352083] CPU: 1 PID: 11469 Comm: perf_fuzzer Tainted: G        W         5.2.0-rc1+ #38
[ 5552.352084] Hardware name: LENOVO 10FY0017US/SKYBAY, BIOS FWKT53A   06/06/2016
[ 5552.352086] RIP: 0010:perf_reg_value+0x45/0x50
[ 5552.352089] Code: 48 63 f6 48 8b 84 f2 00 ff ff ff c3 31 c0 c3 83 fe 17 77 16 48 63 f6 8b 04 b5 60 a4 a0 8f 3d a0 00 00 00 77 e7 48 8b 04 07 c3 <0f> 0b 31 c0 c3 66 0f 1f 44 00 00 0f 1f 44 00 00 48 85 ff 74 12 81
[ 5552.352090] RSP: 0000:ffffa13005f23bd8 EFLAGS: 00010206
[ 5552.352092] RAX: 00000000fffffffd RBX: 000000000000001d RCX: 000000000000001d
[ 5552.352093] RDX: 000000000000001d RSI: 000000000000001d RDI: ffffa13005f23f58
[ 5552.352094] RBP: ffffa13005f23c90 R08: 0000000000000000 R09: 0000000000029340
[ 5552.352096] R10: 0000114c8f85b92c R11: 0000000000000001 R12: ffffa13005f23f58
[ 5552.352097] R13: ffff8cc1aa3f4030 R14: 0000000000000030 R15: 0000000000000000
[ 5552.352098] FS:  00007f2154803540(0000) GS:ffff8cc1b5a40000(0000) knlGS:0000000000000000
[ 5552.352100] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 5552.352101] CR2: 00007ffe0cb894f8 CR3: 000000022d87e006 CR4: 00000000003607e0
[ 5552.352102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 5552.352103] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[ 5552.352104] Call Trace:
[ 5552.352109]  perf_output_sample_regs+0x43/0xa0
[ 5552.352115]  perf_output_sample+0x3aa/0x7a0
[ 5552.352119]  perf_event_output_forward+0x53/0x80
[ 5552.352123]  __perf_event_overflow+0x52/0xf0
[ 5552.352126]  perf_swevent_overflow+0x99/0xc0
[ 5552.352128]  ___perf_sw_event+0xe7/0x120
[ 5552.352131]  ? ptep_set_access_flags+0x23/0x30
[ 5552.352134]  ? do_wp_page+0x2c5/0x5c0
[ 5552.352136]  ? __handle_mm_fault+0xba8/0x1220
[ 5552.352140]  ? _cond_resched+0x15/0x30
[ 5552.352143]  ? handle_mm_fault+0xc2/0x1d0
[ 5552.352146]  ? __do_page_fault+0x268/0x4f0
[ 5552.352149]  ? page_fault+0x8/0x30
[ 5552.352151]  __perf_sw_event+0x55/0xa0
[ 5552.352154]  page_fault+0x1e/0x30
[ 5552.352157] RIP: 0033:0x55e5a5ec6494
[ 5552.352159] Code: b8 00 00 00 00 e8 bc 2c ff ff 48 8b 05 c5 a2 22 00 48 83 c0 01 48 89 05 ba a2 22 00 90 c9 c3 55 48 89 e5 48 81 ec 10 24 00 00 <e8> 07 30 ff ff 89 c2 89 d0 c1 f8 1f c1 e8 19 01 c2 83 e2 7f 29 c2
[ 5552.352160] RSP: 002b:00007ffe0cb89500 EFLAGS: 00010206
[ 5552.352161] RAX: 0000000000000400 RBX: 000000000000000c RCX: 0000000000000008
[ 5552.352162] RDX: 000055e5a5ecd9c0 RSI: 00007ffe0cb8b8f4 RDI: 00007f21547fc740
[ 5552.352163] RBP: 00007ffe0cb8b910 R08: 00007f21547fc1c4 R09: 00007f21547fc240
[ 5552.352164] R10: 0000000000000001 R11: 0000000000000202 R12: 000055e5a5eb94c0
[ 5552.352165] R13: 00007ffe0cb8dd00 R14: 0000000000000000 R15: 0000000000000000
[ 5552.352168] ---[ end trace 199d9be3b0c594ae ]---