Re: [PATCH v2 2/3] perf/amd/ibs: Fix kernel address leak via REGS_USER and REGS_INTR

[Jim Mattson]

On Sun, Oct 25, 2026 at 9:19 PM Ravi Bangoria <ravi.bangoria@xxxxxxx> wrote:
>
> IBS hardware captures a sample and raises an NMI. Since the NMI can be
> delivered with a delay, a privilege change may occur between sample
> capture and NMI delivery. Because IBS only provides the sample RIP, the
> kernel records GPRs from the NMI pt_regs, which may reflect kernel mode
> if a privilege switch occurred in the interim. This can leak kernel
> addresses to unprivileged users through PERF_SAMPLE_REGS_USER and/or
> PERF_SAMPLE_REGS_INTR.
>
> Fix this by using interrupt regs while preparing PERF_SAMPLE_REGS_USER
> and PERF_SAMPLE_REGS_INTR. With the change, when IBS samples a user mode
> instruction but the NMI is delivered in kernel mode, PERF_SAMPLE_REGS_USER
> will source its register state from task_pt_regs(current) and
> PERF_SAMPLE_REGS_INTR will be omitted from the data sent to userspace.
>
> In addition to fixing the kernel address leak, this change also ensures
> GPR snapshot consistency, which resolves the DWARF unwinding issue with
> IBS.
>
> Reported-by: Gennady Kupava <gennady.kupava@xxxxxxxxx>
> Closes: https://lore.kernel.org/r/CAPu-DQqF0aF6=GS8Z6KKWeeX_V5LiXeKU_rJQZC+uGg8zuTPNw@xxxxxxxxxxxxxx
> Reported-by: Jayapal Ashwin Nair <janair@xxxxxxx>
> Fixes: d29e744c7167 ("perf/x86: Relax privilege filter restriction on AMD IBS")
> Signed-off-by: Ravi Bangoria <ravi.bangoria@xxxxxxx>
Reviewed-by: Jim Mattson <jmattson@xxxxxxxxxx>