linux-kernel - Re: [PATCH] perf/x86/amd: check event before enable to avoid GPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <57bcb95d-8a1c-4903-af8c-b4b08d1270c3@oracle.com>
Date: Mon, 3 Jun 2024 09:30:25 -0400
From: George Kennedy <george.kennedy@...cle.com>
To: Ravi Bangoria <ravi.bangoria@....com>
Cc: harshit.m.mogalapalli@...cle.com, peterz@...radead.org, mingo@...hat.com,
        acme@...nel.org, namhyung@...nel.org, mark.rutland@....com,
        alexander.shishkin@...ux.intel.com, jolsa@...nel.org,
        irogers@...gle.com, adrian.hunter@...el.com, kan.liang@...ux.intel.com,
        tglx@...utronix.de, bp@...en8.de, dave.hansen@...ux.intel.com,
        x86@...nel.org, hpa@...or.com, linux-perf-users@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] perf/x86/amd: check event before enable to avoid GPF



On 6/3/2024 12:39 AM, Ravi Bangoria wrote:
> Hi George,
>
>>>> Syzkaller reported a GPF in amd_pmu_enable_all.
>>> Can you please provide a bug report link? Also, any reproducer?
>> The Syzkaller reproducer can be found in this link:
>> https://lore.kernel.org/netdev/CAMt6jhyec7-TSFpr3F+_ikjpu39WV3jnCBBGwpzpBrPx55w20g@mail.gmail.com/T/#u
> I'm _not_ able to reproduce the issue with this syzkaller reproducer. I ran
> it for more than 12 hours. Here is my setup.
>
> - EYPC Zen3 Milan _host_
> - Fedora 40
> - v6.9 vanilla kernel with attached config
> - Syzkaller command running as a root
>    # ./syz-execprog -executor=./syz-executor -threaded=1 -repeat=0 -procs=8 2-repro.prog
> - Also tried with C program generated using:
>    # ./syz-prog2c -procs=8 -repeat=0 -threaded=1 -tmpdir=1 -segv=true -prog=2-repro.prog > 2-repro.c
processor    : 0
vendor_id    : AuthenticAMD
cpu family    : 23
model        : 1
model name    : AMD EPYC 7551 32-Core Processor
stepping    : 2
microcode    : 0x800126e
cpu MHz        : 2000.000
cache size    : 512 KB
physical id    : 0
siblings    : 64
core id        : 0
cpu cores    : 32
apicid        : 0
initial apicid    : 0
fpu        : yes
fpu_exception    : yes
cpuid level    : 13
wp        : yes
flags        : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca 
cmov pat pse36 clflush mmx fxsr sse sse2 ht sysca
ll nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl 
nonstop_tsc cpuid extd_apicid amd_dcm aperfmperf rapl pni
  pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave 
avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_le
gacy abm sse4a misalignsse 3dnowprefetch osvw skinit wdt tce topoext 
perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb hw
_pstate ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap 
clflushopt sha_ni xsaveopt xsavec xgetbv1 nt_good clz
ero irperf xsaveerptr arat npt lbrv svm_lock nrip_save tsc_scale 
vmcb_clean flushbyasid decodeassists pausefilter pfthreshol
d avic v_vmsave_vmload vgif overflow_recov succor smca
bugs        : div0 sysret_ss_attrs null_seg spectre_v1 spectre_v2 
spec_store_bypass retbleed smt_rsb srso
bogomips    : 3992.29
TLB size    : 2560 4K pages
clflush size    : 64
cache_alignment    : 64
address sizes    : 48 bits physical, 48 bits virtual
power management: ts ttp tm hwpstate cpb eff_freq_ro [13] [14]

Try these repro steps instead:
syz-prog2c -prog repro.prog -threaded -repeat 0 -procs 8 -slowdown 1 
-sandbox none -sandbox_arg 0 -enable net_reset -enable net_dev -enable 
cgroups -tmpdir -enable binfmt_misc -enable close_fds -enable sysctl 
-segv >repro.c

>
> Can you please provide your config and system detail in case you are able
> to reproduce it.

See attached for repro C and config.

Thanks,
George

>
> Thanks,
> Ravi

View attachment "config.repro" of type "text/plain" (240258 bytes)

View attachment "repro.c" of type "text/plain" (18644 bytes)

View attachment "repro_x86_pmu_enable_event.c" of type "text/plain" (9287 bytes)