linux-kernel - Re: [tip: perf/urgent] perf/x86: Check data address for IBS software filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z9hGYP76E6dDEppS@google.com>
Date: Mon, 17 Mar 2025 08:57:20 -0700
From: Namhyung Kim <namhyung@...nel.org>
To: Borislav Petkov <bp@...en8.de>
Cc: linux-kernel@...r.kernel.org, linux-tip-commits@...r.kernel.org,
	Matteo Rizzo <matteorizzo@...gle.com>,
	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>, x86@...nel.org
Subject: Re: [tip: perf/urgent] perf/x86: Check data address for IBS software
 filter

On Mon, Mar 17, 2025 at 11:10:48AM +0100, Borislav Petkov wrote:
> On Mon, Mar 17, 2025 at 09:15:05AM -0000, tip-bot2 for Namhyung Kim wrote:
> > The following commit has been merged into the perf/urgent branch of tip:
> > 
> > Commit-ID:     b0be17d8108bf3448a58be319d085155a128cf3a
> > Gitweb:        https://git.kernel.org/tip/b0be17d8108bf3448a58be319d085155a128cf3a
> > Author:        Namhyung Kim <namhyung@...nel.org>
> > AuthorDate:    Mon, 17 Mar 2025 01:10:58 -07:00
> > Committer:     Ingo Molnar <mingo@...nel.org>
> > CommitterDate: Mon, 17 Mar 2025 10:04:31 +01:00
> > 
> > perf/x86: Check data address for IBS software filter
> > 
> > The IBS software filter is filtering kernel samples for regular users in
> > PMI handler.  It checks the instruction address in the IBS register to
> > determine if it was in the kernel mode or not.
> > 
> > But it turns out that it's possible to report a kernel data address even
> > if the instruction address belongs to the user space.  Matteo Rizzo
> > found that when an instruction raises an exception, IBS can report some
> > kernel data address like IDT while holding the faulting instruction's
> > RIP.  To prevent an information leak, it should double check if the data
> > address in PERF_SAMPLE_DATA is in the kernel space as well.
> > 
> > Suggested-by: Matteo Rizzo <matteorizzo@...gle.com>
> > Signed-off-by: Namhyung Kim <namhyung@...nel.org>
> > Signed-off-by: Ingo Molnar <mingo@...nel.org>
> > Cc: Peter Zijlstra <peterz@...radead.org>
> > Link: https://lore.kernel.org/r/20250317081058.1794729-1-namhyung@kernel.org
> > ---
> >  arch/x86/events/amd/ibs.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> > 
> > diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
> > index e7a8b87..24985c7 100644
> > --- a/arch/x86/events/amd/ibs.c
> > +++ b/arch/x86/events/amd/ibs.c
> > @@ -1147,6 +1147,13 @@ fail:
> >  	if (perf_ibs == &perf_ibs_op)
> >  		perf_ibs_parse_ld_st_data(event->attr.sample_type, &ibs_data, &data);
> >  
> > +	if ((event->attr.config2 & IBS_SW_FILTER_MASK) &&
> > +	    (event->attr.sample_type & PERF_SAMPLE_ADDR) &&
> > +	    event->attr.exclude_kernel && !access_ok(data.addr)) {
> > +		throttle = perf_event_account_interrupt(event);
> > +		goto out;
> > +	}
> 
> Did anyone build this?

Oops, sorry about this.  I fixed it locally but sent the one before
adding the change.  Will send v2.

Thanks,
Namhyung


> 
> arch/x86/events/amd/ibs.c: In function ‘perf_ibs_handle_irq’:
> arch/x86/events/amd/ibs.c:1291:63: error: macro "access_ok" requires 2 arguments, but only 1 given
>  1291 |             event->attr.exclude_kernel && !access_ok(data.addr)) {
>       |                                                               ^
> In file included from ./arch/x86/include/asm/uaccess.h:25,
>                  from ./include/linux/uaccess.h:12,
>                  from ./include/linux/sched/task.h:13,
>                  from ./include/linux/sched/signal.h:9,
>                  from ./include/linux/ptrace.h:7,
>                  from ./include/uapi/asm-generic/bpf_perf_event.h:4,
>                  from ./arch/x86/include/generated/uapi/asm/bpf_perf_event.h:1,
>                  from ./include/uapi/linux/bpf_perf_event.h:11,
>                  from ./include/linux/perf_event.h:18,
>                  from arch/x86/events/amd/ibs.c:9:
> ./include/asm-generic/access_ok.h:45: note: macro "access_ok" defined here
>    45 | #define access_ok(addr, size) likely(__access_ok(addr, size))
>       | 
> arch/x86/events/amd/ibs.c:1291:44: error: ‘access_ok’ undeclared (first use in this function)
>  1291 |             event->attr.exclude_kernel && !access_ok(data.addr)) {
>       |                                            ^~~~~~~~~
> arch/x86/events/amd/ibs.c:1291:44: note: each undeclared identifier is reported only once for each function it appears in
> make[5]: *** [scripts/Makefile.build:207: arch/x86/events/amd/ibs.o] Error 1
> make[4]: *** [scripts/Makefile.build:465: arch/x86/events/amd] Error 2
> make[4]: *** Waiting for unfinished jobs....
> make[3]: *** [scripts/Makefile.build:465: arch/x86/events] Error 2
> make[3]: *** Waiting for unfinished jobs....
> make[2]: *** [scripts/Makefile.build:465: arch/x86] Error 2
> make[2]: *** Waiting for unfinished jobs....
> make[1]: *** [/mnt/kernel/kernel/6th/linux/Makefile:1997: .] Error 2
> make: *** [Makefile:251: __sub-make] Error 2
> 
> -- 
> Regards/Gruss,
>     Boris.
> 
> https://people.kernel.org/tglx/notes-about-netiquette