linux-kernel - Re: [PATCH] perf/x86/intel/lbr: Fix unchecked MSR access error on HSW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Jul 2022 15:57:37 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     kan.liang@...ux.intel.com
Cc:     mingo@...hat.com, acme@...nel.org, vincent.weaver@...ne.edu,
        linux-kernel@...r.kernel.org, mark.rutland@....com,
        alexander.shishkin@...ux.intel.com, jolsa@...nel.org,
        namhyung@...nel.org, pawan.kumar.gupta@...ux.intel.com,
        stable@...r.kernel.org
Subject: Re: [PATCH] perf/x86/intel/lbr: Fix unchecked MSR access error on HSW

On Thu, Jul 14, 2022 at 11:26:30AM -0700, kan.liang@...ux.intel.com wrote:
> From: Kan Liang <kan.liang@...ux.intel.com>
> 
> The fuzzer triggers the below trace.
> 
> [ 7763.384369] unchecked MSR access error: WRMSR to 0x689
> (tried to write 0x1fffffff8101349e) at rIP: 0xffffffff810704a4
> (native_write_msr+0x4/0x20)
> [ 7763.397420] Call Trace:
> [ 7763.399881]  <TASK>
> [ 7763.401994]  intel_pmu_lbr_restore+0x9a/0x1f0
> [ 7763.406363]  intel_pmu_lbr_sched_task+0x91/0x1c0
> [ 7763.410992]  __perf_event_task_sched_in+0x1cd/0x240
> 
> On a machine with the LBR format LBR_FORMAT_EIP_FLAGS2, when the TSX is
> disabled, a TSX quirk is required to access LBR from registers.
> The lbr_from_signext_quirk_needed() is introduced to determine whether
> the TSX quirk should be applied. However, the
> lbr_from_signext_quirk_needed() is invoked before the
> intel_pmu_lbr_init(), which parses the LBR format information. Without
> the correct LBR format information, the TSX quirk never be applied.
> 
> Move the lbr_from_signext_quirk_needed() into the intel_pmu_lbr_init().
> Checking x86_pmu.lbr_has_tsx in the lbr_from_signext_quirk_needed() is
> not required anymore.
> 
> Both LBR_FORMAT_EIP_FLAGS2 and LBR_FORMAT_INFO have LBR_TSX flag, but
> only the LBR_FORMAT_EIP_FLAGS2 requirs the quirk. Update the comments
> accordingly.
> 
> Fixes: 1ac7fd8159a8 ("perf/x86/intel/lbr: Support LBR format V7")
> Reported-by: Vince Weaver <vincent.weaver@...ne.edu>
> Signed-off-by: Kan Liang <kan.liang@...ux.intel.com>

Thanks!