linux-kernel - Re: [perf] crashing bug in icl_update_topdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d8c64a21-ed4e-4d37-8d4b-9d3a9857b7fd@linux.intel.com>
Date: Wed, 11 Jun 2025 14:53:23 -0400
From: "Liang, Kan" <kan.liang@...ux.intel.com>
To: Vince Weaver <vincent.weaver@...ne.edu>
Cc: linux-kernel@...r.kernel.org, linux-perf-users@...r.kernel.org,
 Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>,
 Arnaldo Carvalho de Melo <acme@...nel.org>,
 Namhyung Kim <namhyung@...nel.org>, Mark Rutland <mark.rutland@....com>,
 Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
 Jiri Olsa <jolsa@...nel.org>, Ian Rogers <irogers@...gle.com>,
 Adrian Hunter <adrian.hunter@...el.com>
Subject: Re: [perf] crashing bug in icl_update_topdown_event



On 2025-06-11 10:57 a.m., Vince Weaver wrote:
> On Wed, 11 Jun 2025, Vince Weaver wrote:
> 
>> Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000
>> CPU: 23 UID: 0 PID: 0 Comm: swapper/23
>> Tainted: [W]=WARN
>> Hardware name: Dell Inc. Precision 9660/0VJ762
>> RIP: 0010:native_read_pmc+0x7/0x40
>> Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ...
>> RSP: 000:fffb03100273de8 EFLAGS: 00010046
> 
> one additional note that's probably relevant, this is on a hybrid CPU 
> machine, so CPUs 16-23 are atom cores that don't support topdown.
> 
> So the crash is probably because for whatever reason the kernel is trying 
> to read topdown events on an unsupported core and triggering a GPF.
> 

It seems an regression from the f9bdf1f95339 ("perf/x86/intel: Avoid
disable PMU if !cpuc->enabled in sample read").
The commit merged the intel_pmu_auto_reload_read() and
intel_pmu_read_topdown_event(). It's possible that a PEBS event 0x0400
runs on a ATOM CPU. So the PERF_X86_EVENT_AUTO_RELOAD is set for the
event. The is_topdown_event() also returns true.

Does the below patch help?
It checks the PERF_X86_EVENT_TOPDOWN flag as well before invoking the
topdown functions.

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index c60b6f199f51..67f80a683234 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2826,7 +2826,8 @@ static void intel_pmu_read_event(struct perf_event
*event)
 		 * If the PEBS counters snapshotting is enabled,
 		 * the topdown event is available in PEBS records.
 		 */
-		if (is_topdown_event(event) && !is_pebs_counter_event_group(event))
+		if (is_topdown_count(event) && is_topdown_event(event) &&
+		    !is_pebs_counter_event_group(event))
 			static_call(intel_pmu_update_topdown_event)(event, NULL);
 		else
 			intel_pmu_drain_pebs_buffer();


Thanks,
Kan