Re: [PATCH] perf/amd/ibs: Report physical address for IBS fetch samples

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Kernel stack buffer overflow when reading MSR_AMD64_IBSOPDATA4.
--

commit 7872bc1d9818cf858d57204bd43f4a048e54da52
Author: Huang Shijie <huangsj@hygon.cn>

perf/amd/ibs: Report physical address for IBS fetch samples

The IBS Fetch sampling does not report the physical address of the
fetched instruction even when PERF_SAMPLE_PHYS_ADDR is requested,
while IBS Op sampling does. This patch reports physical address for
IBS fetch samples which can be used for profiling the running program.

> diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
> index 3531f9c23b8c9..e5376ad5b2ecd 100644
> --- a/arch/x86/events/amd/ibs.c
> +++ b/arch/x86/events/amd/ibs.c
[ ... ]
> @@ -1555,6 +1575,8 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs)
>  
>  	if (perf_ibs == &perf_ibs_op)
>  		perf_ibs_parse_ld_st_data(event->attr.sample_type, &ibs_data, &data);
> +	else
> +		perf_ibs_parse_fetch_data(event->attr.sample_type, &ibs_data, &data);

[Severity: High]
This is a pre-existing issue, but does reading MSR_AMD64_IBSOPDATA4 earlier
in perf_ibs_handle_irq() overflow ibs_data.regs[] when both IBS_CAPS_BRNTRGT
and IBS_CAPS_OPDATA4 are present?

The ibs_data.regs array has a fixed size of MSR_AMD64_IBS_REG_COUNT_MAX (8).
If a user requests PERF_SAMPLE_RAW on a CPU supporting both features (like
Zen 4), the interrupt handler reads 7 base registers, an 8th register for
IBSBRTARGET, and a 9th for IBSOPDATA4.

This writes the 9th MSR value into ibs_data.regs[8] on the kernel stack:

    if (ibs_caps & IBS_CAPS_OPDATA4) {
        rdmsrq(MSR_AMD64_IBSOPDATA4, *buf++);
        size++;
    }

Can this corrupt adjacent stack memory when buf advances out of bounds?

>  
>  	/*
>  	 * rip recorded by IbsOpRip will not be consistent with rsp and rbp

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903054422.148739-1-huangsj@hygon.cn?part=1