Re: [RESEND Patch v10 13/23] perf/x86: Support XMM sampling using sample_simd_vec_reg_* fields

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Downcast of `struct pt_regs` to `struct x86_perf_regs` for software events leads to an out-of-bounds read and potential arbitrary memory read or local DoS.
--

--- Patch [13]: [RESEND Patch v10 13/23] perf/x86: Support XMM sampling using sample_simd_vec_reg_* fields ---
commit 19bc56fc15fa41117febd46977ed2032c46e92f4
Author: Dapeng Mi <dapeng1.mi@linux.intel.com>
Subject: perf/x86: Support XMM sampling using sample_simd_vec_reg_* fields

This commit supports sampling of XMM registers using the newly introduced
sample_simd_vec_reg_* fields. A new abi field is introduced in struct
x86_perf_regs to accommodate layout information for perf_reg_value.

> diff --git a/arch/x86/kernel/perf_regs.c b/arch/x86/kernel/perf_regs.c
> index 81204cb7f7239..bccf0fc275116 100644
> --- a/arch/x86/kernel/perf_regs.c
> +++ b/arch/x86/kernel/perf_regs.c
> @@ -63,6 +63,9 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
>  
>  	if (idx >= PERF_REG_X86_XMM0 && idx < PERF_REG_X86_XMM_MAX) {
>  		perf_regs = container_of(regs, struct x86_perf_regs, regs);
> +		/* SIMD registers are moved to dedicated sample_simd_vec_reg */
> +		if (perf_regs->abi & PERF_SAMPLE_REGS_ABI_SIMD)
> +			return 0;
>  		if (!perf_regs->xmm_regs)
>  			return 0;

[Severity: High]
This is a pre-existing issue, but does using container_of() here lead to an
out-of-bounds read for software events?

If a user creates a software event (e.g., PERF_TYPE_SOFTWARE) with
PERF_SAMPLE_REGS_USER and sets an XMM register bit in sample_regs_user,
perf_reg_validate() fails to reject bits >= 32. When the event triggers,
perf_output_sample_regs() calls perf_reg_value() with a raw pt_regs
pointer from task_pt_regs(current).

Because task_pt_regs is typically located at the very top of the kernel
stack page, downcasting it to struct x86_perf_regs and reading
perf_regs->abi or perf_regs->xmm_regs accesses memory past the end of
the pt_regs structure.

Can this cross into the adjacent vmap guard page and cause a kernel panic,
or leak adjacent memory if triggered via nested interrupts or kprobes
where the pt_regs is in the middle of the stack?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824082731.1013973-1-dapeng1.mi@linux.intel.com?part=13