linux-kernel - Re: [PATCH] perf/x86/intel: Fix unchecked PEBS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <bbdb6e1a-546a-4ed9-9d91-8d334fd5cc7b@linux.intel.com>
Date: Fri, 20 Jun 2025 13:45:49 -0400
From: "Liang, Kan" <kan.liang@...ux.intel.com>
To: peterz@...radead.org, mingo@...hat.com, acme@...nel.org,
 namhyung@...nel.org, linux-kernel@...r.kernel.org,
 linux-perf-users@...r.kernel.org
Cc: Vince Weaver <vincent.weaver@...ne.edu>, stable@...r.kernel.org
Subject: Re: [PATCH] perf/x86/intel: Fix unchecked PEBS_ENABLE MSR access
 error

Hi Peter and Ingo,

On 2025-06-20 7:04 a.m., kan.liang@...ux.intel.com wrote:
> From: Kan Liang <kan.liang@...ux.intel.com>
> 
> perf_fuzzzer reported an unchecked MSR access error.
> 
> [12646.001692] unchecked MSR access error: WRMSR to 0x3f1
> (tried to write 0x0001000000000001) at
> rIP: 0xffffffffa98932af (native_write_msr+0xf/0x20)
> [12646.001698] Call Trace:
> [12646.001700]  <TASK>
> [12646.001700]  intel_pmu_pebs_enable_all+0x2c/0x40
> [12646.001703]  intel_pmu_enable_all+0xe/0x20
> [12646.001705]  ctx_resched+0x227/0x280
> [12646.001708]  event_function+0x8f/0xd0
> 
> Thank Vince very much for providing a small reproducible test case.
> https://lore.kernel.org/lkml/d12d4300-9926-5e58-6515-a53cb5c7bee0@maine.edu/
> 
> The error is because perf mistakenly creates a precise Topdown perf
> metrics event, INTEL_TD_METRIC_RETIRING, which uses the idx 48
> internally.
> The Topdown perf metrics events never be a precise event (PEBS). Any
> illegal creation should be filtered out by the intel_pmu_hw_config.
> However, the is_available_metric_event() failed to detect the Topdown
> perf metrics event. The filter is not applied.
> 
> To detect an event, the pure event encoding should be used, rather than
> the whole event->attr.config. Only check the pure event encoding in
> is_available_metric_event.
> 
> Fixes: 1ab5f235c176 ("perf/x86/intel: Filter unsupported Topdown metrics event")
> Reported-by: Vince Weaver <vincent.weaver@...ne.edu>
> Closes: https://lore.kernel.org/lkml/14d3167e-4dad-f68e-822f-21cd86eab873@maine.edu/
> Signed-off-by: Kan Liang <kan.liang@...ux.intel.com>
> Cc: stable@...r.kernel.org

Please also apply the tested-by from Vince if the patch looks good to you.
Tested-by: Vince Weaver <vincent.weaver@...ne.edu>
https://lore.kernel.org/lkml/5a53490f-d4ec-85f7-4175-e148e02c3e67@maine.edu/

Thanks,
Kan> ---
>  arch/x86/events/intel/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
> index 8f2e36ad89db..bf5ca4cb232b 100644
> --- a/arch/x86/events/intel/core.c
> +++ b/arch/x86/events/intel/core.c
> @@ -4082,7 +4082,7 @@ static int core_pmu_hw_config(struct perf_event *event)
>  static bool is_available_metric_event(struct perf_event *event)
>  {
>  	return is_metric_event(event) &&
> -		event->attr.config <= INTEL_TD_METRIC_AVAILABLE_MAX;
> +	       (event->attr.config & INTEL_ARCH_EVENT_MASK) <= INTEL_TD_METRIC_AVAILABLE_MAX;
>  }
>  
>  static inline bool is_mem_loads_event(struct perf_event *event)