Re: [PATCH] perf/x86/amd: check event before enable to avoid GPF

[Ravi Bangoria]

>>>>> Syzkaller reported a GPF in amd_pmu_enable_all.
>>>> Can you please provide a bug report link? Also, any reproducer?
>>> The Syzkaller reproducer can be found in this link:
>>> https://lore.kernel.org/netdev/CAMt6jhyec7-TSFpr3F+_ikjpu39WV3jnCBBGwpzpBrPx55w20g@xxxxxxxxxxxxxx/T/#u
>> I'm _not_ able to reproduce the issue with this syzkaller reproducer. I ran
>> it for more than 12 hours. Here is my setup.
>>
>> - EYPC Zen3 Milan _host_
>> - Fedora 40
>> - v6.9 vanilla kernel with attached config
>> - Syzkaller command running as a root
>>    # ./syz-execprog -executor=./syz-executor -threaded=1 -repeat=0 -procs=8 2-repro.prog
>> - Also tried with C program generated using:
>>    # ./syz-prog2c -procs=8 -repeat=0 -threaded=1 -tmpdir=1 -segv=true -prog=2-repro.prog > 2-repro.c
> processor    : 0
> vendor_id    : AuthenticAMD
> cpu family    : 23
> model        : 1
> model name    : AMD EPYC 7551 32-Core Processor
> stepping    : 2
> microcode    : 0x800126e
> cpu MHz        : 2000.000
> cache size    : 512 KB
> physical id    : 0
> siblings    : 64
> core id        : 0
> cpu cores    : 32
> apicid        : 0
> initial apicid    : 0
> fpu        : yes
> fpu_exception    : yes
> cpuid level    : 13
> wp        : yes
> flags        : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht sysca
> ll nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid amd_dcm aperfmperf rapl pni
>  pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_le
> gacy abm sse4a misalignsse 3dnowprefetch osvw skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb hw
> _pstate ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 nt_good clz
> ero irperf xsaveerptr arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshol
> d avic v_vmsave_vmload vgif overflow_recov succor smca
> bugs        : div0 sysret_ss_attrs null_seg spectre_v1 spectre_v2 spec_store_bypass retbleed smt_rsb srso
> bogomips    : 3992.29
> TLB size    : 2560 4K pages
> clflush size    : 64
> cache_alignment    : 64
> address sizes    : 48 bits physical, 48 bits virtual
> power management: ts ttp tm hwpstate cpb eff_freq_ro [13] [14]
> 
> Try these repro steps instead:
> syz-prog2c -prog repro.prog -threaded -repeat 0 -procs 8 -slowdown 1 -sandbox none -sandbox_arg 0 -enable net_reset -enable net_dev -enable cgroups -tmpdir -enable binfmt_misc -enable close_fds -enable sysctl -segv >repro.c
> 
>>
>> Can you please provide your config and system detail in case you are able
>> to reproduce it.
> 
> See attached for repro C and config.
No luck with your reproducers as well :(. My kernel config is almost same as
yours:

$ ./scripts/diffconfig 2-config.repro .config
-CC_HAS_AUTO_VAR_INIT_PATTERN y
-CC_HAS_AUTO_VAR_INIT_ZERO y
-CC_HAS_AUTO_VAR_INIT_ZERO_BARE y
-CC_HAS_KASAN_MEMINTRINSIC_PREFIX y
-INIT_STACK_ALL_PATTERN n
-INIT_STACK_ALL_ZERO y
-TOOLS_SUPPORT_RELR y
 AS_VERSION 24000 -> 23502
 CC_VERSION_TEXT "gcc (GCC) 13.1.1 20230614 (Red Hat 13.1.1-43..0.1)" -> "gcc (GCC) 11.4.1 20231218 (Red Hat 11.4.1-3)"
 GCC_VERSION 130101 -> 110401
 INIT_STACK_NONE n -> y
 LD_VERSION 24000 -> 23502
 LOCALVERSION "" -> "-ravi"
 PAHOLE_VERSION 0 -> 125
+PAHOLE_HAS_LANG_EXCLUDE y
+PAHOLE_HAS_SPLIT_BTF y

And I'm trying on Zen1 test machine:

processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 23
model           : 1
model name      : AMD EPYC 7601 32-Core Processor
stepping        : 2
microcode       : 0x800126e
cpu MHz         : 2692.575
cache size      : 512 KB
physical id     : 0
siblings        : 64
core id         : 0
cpu cores       : 32
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 13
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid amd_dcm aperfmperf rapl pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb hw_pstate ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 xsaves clzero irperf xsaveerptr arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif overflow_recov succor smca sev sev_es
bugs            : sysret_ss_attrs null_seg spectre_v1 spectre_v2 spec_store_bypass retbleed smt_rsb srso div0
bogomips        : 4391.65
TLB size        : 2560 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 43 bits physical, 48 bits virtual
power management: ts ttp tm hwpstate cpb eff_freq_ro [13] [14]