linux-kernel - Re: perf: fuzzer causes crash in new XMM code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 23 May 2019 14:33:41 -0400
From:   "Liang, Kan" <kan.liang@...ux.intel.com>
To:     Vince Weaver <vincent.weaver@...ne.edu>
Cc:     Andi Kleen <ak@...ux.intel.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Arnaldo Carvalho de Melo <acme@...hat.com>,
        Jiri Olsa <jolsa@...hat.com>,
        Stephane Eranian <eranian@...gle.com>,
        Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: perf: fuzzer causes crash in new XMM code



On 5/23/2019 12:30 PM, Vince Weaver wrote:
> On Wed, 22 May 2019, Liang, Kan wrote:
> 
>> XMM registers can only collected by hardware PEBS events. We should disable it
>> for all software/probe events.
>>
>> Could you please try the patch as below?
> 
> I tested the patch (it was whitespace damaged for some reason, not
> sure if that was on my end though).
>
> Running a few hours here, it hasn't crashed, but it did produce this
> warning which appears to map to:
> 	if (WARN_ON_ONCE(idx >= ARRAY_SIZE(pt_regs_offset)))
> 		return 0;

The reserved bits between XMM and generic registers are not checked.

I will re-send the first patch and a new patch for this issue in 
separate email.

Thanks,
Kan

> 
> [ 5552.352046] WARNING: CPU: 1 PID: 11469 at arch/x86/kernel/perf_regs.c:76 perf_reg_value+0x45/0x50
> [ 5552.352083] CPU: 1 PID: 11469 Comm: perf_fuzzer Tainted: G        W         5.2.0-rc1+ #38
> [ 5552.352084] Hardware name: LENOVO 10FY0017US/SKYBAY, BIOS FWKT53A   06/06/2016
> [ 5552.352086] RIP: 0010:perf_reg_value+0x45/0x50
> [ 5552.352089] Code: 48 63 f6 48 8b 84 f2 00 ff ff ff c3 31 c0 c3 83 fe 17 77 16 48 63 f6 8b 04 b5 60 a4 a0 8f 3d a0 00 00 00 77 e7 48 8b 04 07 c3 <0f> 0b 31 c0 c3 66 0f 1f 44 00 00 0f 1f 44 00 00 48 85 ff 74 12 81
> [ 5552.352090] RSP: 0000:ffffa13005f23bd8 EFLAGS: 00010206
> [ 5552.352092] RAX: 00000000fffffffd RBX: 000000000000001d RCX: 000000000000001d
> [ 5552.352093] RDX: 000000000000001d RSI: 000000000000001d RDI: ffffa13005f23f58
> [ 5552.352094] RBP: ffffa13005f23c90 R08: 0000000000000000 R09: 0000000000029340
> [ 5552.352096] R10: 0000114c8f85b92c R11: 0000000000000001 R12: ffffa13005f23f58
> [ 5552.352097] R13: ffff8cc1aa3f4030 R14: 0000000000000030 R15: 0000000000000000
> [ 5552.352098] FS:  00007f2154803540(0000) GS:ffff8cc1b5a40000(0000) knlGS:0000000000000000
> [ 5552.352100] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 5552.352101] CR2: 00007ffe0cb894f8 CR3: 000000022d87e006 CR4: 00000000003607e0
> [ 5552.352102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 5552.352103] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
> [ 5552.352104] Call Trace:
> [ 5552.352109]  perf_output_sample_regs+0x43/0xa0
> [ 5552.352115]  perf_output_sample+0x3aa/0x7a0
> [ 5552.352119]  perf_event_output_forward+0x53/0x80
> [ 5552.352123]  __perf_event_overflow+0x52/0xf0
> [ 5552.352126]  perf_swevent_overflow+0x99/0xc0
> [ 5552.352128]  ___perf_sw_event+0xe7/0x120
> [ 5552.352131]  ? ptep_set_access_flags+0x23/0x30
> [ 5552.352134]  ? do_wp_page+0x2c5/0x5c0
> [ 5552.352136]  ? __handle_mm_fault+0xba8/0x1220
> [ 5552.352140]  ? _cond_resched+0x15/0x30
> [ 5552.352143]  ? handle_mm_fault+0xc2/0x1d0
> [ 5552.352146]  ? __do_page_fault+0x268/0x4f0
> [ 5552.352149]  ? page_fault+0x8/0x30
> [ 5552.352151]  __perf_sw_event+0x55/0xa0
> [ 5552.352154]  page_fault+0x1e/0x30
> [ 5552.352157] RIP: 0033:0x55e5a5ec6494
> [ 5552.352159] Code: b8 00 00 00 00 e8 bc 2c ff ff 48 8b 05 c5 a2 22 00 48 83 c0 01 48 89 05 ba a2 22 00 90 c9 c3 55 48 89 e5 48 81 ec 10 24 00 00 <e8> 07 30 ff ff 89 c2 89 d0 c1 f8 1f c1 e8 19 01 c2 83 e2 7f 29 c2
> [ 5552.352160] RSP: 002b:00007ffe0cb89500 EFLAGS: 00010206
> [ 5552.352161] RAX: 0000000000000400 RBX: 000000000000000c RCX: 0000000000000008
> [ 5552.352162] RDX: 000055e5a5ecd9c0 RSI: 00007ffe0cb8b8f4 RDI: 00007f21547fc740
> [ 5552.352163] RBP: 00007ffe0cb8b910 R08: 00007f21547fc1c4 R09: 00007f21547fc240
> [ 5552.352164] R10: 0000000000000001 R11: 0000000000000202 R12: 000055e5a5eb94c0
> [ 5552.352165] R13: 00007ffe0cb8dd00 R14: 0000000000000000 R15: 0000000000000000
> [ 5552.352168] ---[ end trace 199d9be3b0c594ae ]---
>