Hi Peter,
On Mon, Mar 17, 2025 at 11:15:04AM +0100, Peter Zijlstra wrote:
> On Mon, Mar 17, 2025 at 09:15:05AM -0000, tip-bot2 for Namhyung Kim wrote:
> > The following commit has been merged into the perf/urgent branch of tip:
> >
> > Commit-ID: b0be17d8108bf3448a58be319d085155a128cf3a
> > Gitweb: https://git.kernel.org/tip/b0be17d8108bf3448a58be319d085155a128cf3a
> > Author: Namhyung Kim <namhyung@xxxxxxxxxx>
> > AuthorDate: Mon, 17 Mar 2025 01:10:58 -07:00
> > Committer: Ingo Molnar <mingo@xxxxxxxxxx>
> > CommitterDate: Mon, 17 Mar 2025 10:04:31 +01:00
> >
> > perf/x86: Check data address for IBS software filter
> >
> > The IBS software filter is filtering kernel samples for regular users in
> > PMI handler. It checks the instruction address in the IBS register to
> > determine if it was in the kernel mode or not.
> >
> > But it turns out that it's possible to report a kernel data address even
> > if the instruction address belongs to the user space. Matteo Rizzo
> > found that when an instruction raises an exception, IBS can report some
> > kernel data address like IDT while holding the faulting instruction's
> > RIP. To prevent an information leak, it should double check if the data
> > address in PERF_SAMPLE_DATA is in the kernel space as well.
> >
> > Suggested-by: Matteo Rizzo <matteorizzo@xxxxxxxxxx>
> > Signed-off-by: Namhyung Kim <namhyung@xxxxxxxxxx>
> > Signed-off-by: Ingo Molnar <mingo@xxxxxxxxxx>
> > Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
> > Link: https://lore.kernel.org/r/20250317081058.1794729-1-namhyung@xxxxxxxxxx
> > ---
> > arch/x86/events/amd/ibs.c | 7 +++++++
> > 1 file changed, 7 insertions(+)
> >
> > diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
> > index e7a8b87..24985c7 100644
> > --- a/arch/x86/events/amd/ibs.c
> > +++ b/arch/x86/events/amd/ibs.c
> > @@ -1147,6 +1147,13 @@ fail:
> > if (perf_ibs == &perf_ibs_op)
> > perf_ibs_parse_ld_st_data(event->attr.sample_type, &ibs_data, &data);
> >
> > + if ((event->attr.config2 & IBS_SW_FILTER_MASK) &&
> > + (event->attr.sample_type & PERF_SAMPLE_ADDR) &&
> > + event->attr.exclude_kernel && !access_ok(data.addr)) {
>
> If only you'd looked at all the other filter code :/ everybody uses
> kernel_ip() helper for this, not access_ok().
I thought it also needs __KERNEL_CS but now I see it only checks the
address. Will change in v2.
Thanks,
Namhyung
>
> > + throttle = perf_event_account_interrupt(event);
> > + goto out;
> > + }
> > +
> > /*
> > * rip recorded by IbsOpRip will not be consistent with rsp and rbp
> > * recorded as part of interrupt regs. Thus we need to use rip from
|