From: Kan Liang <kan.liang@linux.intel.com>

perf_fuzzzer reported an unchecked MSR access error.

[12646.001692] unchecked MSR access error: WRMSR to 0x3f1
(tried to write 0x0001000000000001) at
rIP: 0xffffffffa98932af (native_write_msr+0xf/0x20)
[12646.001698] Call Trace:
[12646.001700]  <TASK>
[12646.001700]  intel_pmu_pebs_enable_all+0x2c/0x40
[12646.001703]  intel_pmu_enable_all+0xe/0x20
[12646.001705]  ctx_resched+0x227/0x280
[12646.001708]  event_function+0x8f/0xd0

Thank Vince very much for providing a small reproducible test case.
https://lore.kernel.org/lkml/d12d4300-9926-5e58-6515-a53cb5c7bee0@maine.edu/

The error is because perf mistakenly creates a precise Topdown perf
metrics event, INTEL_TD_METRIC_RETIRING, which uses the idx 48
internally.
The Topdown perf metrics events never be a precise event (PEBS). Any
illegal creation should be filtered out by the intel_pmu_hw_config.
However, the is_available_metric_event() failed to detect the Topdown
perf metrics event. The filter is not applied.

To detect an event, the pure event encoding should be used, rather than
the whole event->attr.config. Only check the pure event encoding in
is_available_metric_event.

Fixes: 1ab5f235c176 ("perf/x86/intel: Filter unsupported Topdown metrics event")
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Closes: https://lore.kernel.org/lkml/14d3167e-4dad-f68e-822f-21cd86eab873@maine.edu/
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Cc: stable@vger.kernel.org
---
 arch/x86/events/intel/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 8f2e36ad89db..bf5ca4cb232b 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4082,7 +4082,7 @@ static int core_pmu_hw_config(struct perf_event *event)
 static bool is_available_metric_event(struct perf_event *event)
 {
 	return is_metric_event(event) &&
-		event->attr.config <= INTEL_TD_METRIC_AVAILABLE_MAX;
+	       (event->attr.config & INTEL_ARCH_EVENT_MASK) <= INTEL_TD_METRIC_AVAILABLE_MAX;
 }
 
 static inline bool is_mem_loads_event(struct perf_event *event)
-- 
2.38.1

Hi Peter and Ingo,

On 2025-06-20 7:04 a.m., kan.liang@linux.intel.com wrote:
> From: Kan Liang <kan.liang@linux.intel.com>
> 
> perf_fuzzzer reported an unchecked MSR access error.
> 
> [12646.001692] unchecked MSR access error: WRMSR to 0x3f1
> (tried to write 0x0001000000000001) at
> rIP: 0xffffffffa98932af (native_write_msr+0xf/0x20)
> [12646.001698] Call Trace:
> [12646.001700]  <TASK>
> [12646.001700]  intel_pmu_pebs_enable_all+0x2c/0x40
> [12646.001703]  intel_pmu_enable_all+0xe/0x20
> [12646.001705]  ctx_resched+0x227/0x280
> [12646.001708]  event_function+0x8f/0xd0
> 
> Thank Vince very much for providing a small reproducible test case.
> https://lore.kernel.org/lkml/d12d4300-9926-5e58-6515-a53cb5c7bee0@maine.edu/
> 
> The error is because perf mistakenly creates a precise Topdown perf
> metrics event, INTEL_TD_METRIC_RETIRING, which uses the idx 48
> internally.
> The Topdown perf metrics events never be a precise event (PEBS). Any
> illegal creation should be filtered out by the intel_pmu_hw_config.
> However, the is_available_metric_event() failed to detect the Topdown
> perf metrics event. The filter is not applied.
> 
> To detect an event, the pure event encoding should be used, rather than
> the whole event->attr.config. Only check the pure event encoding in
> is_available_metric_event.
> 
> Fixes: 1ab5f235c176 ("perf/x86/intel: Filter unsupported Topdown metrics event")
> Reported-by: Vince Weaver <vincent.weaver@maine.edu>
> Closes: https://lore.kernel.org/lkml/14d3167e-4dad-f68e-822f-21cd86eab873@maine.edu/
> Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
> Cc: stable@vger.kernel.org

Please also apply the tested-by from Vince if the patch looks good to you.
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
https://lore.kernel.org/lkml/5a53490f-d4ec-85f7-4175-e148e02c3e67@maine.edu/

Thanks,
Kan> ---
>  arch/x86/events/intel/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
> index 8f2e36ad89db..bf5ca4cb232b 100644
> --- a/arch/x86/events/intel/core.c
> +++ b/arch/x86/events/intel/core.c
> @@ -4082,7 +4082,7 @@ static int core_pmu_hw_config(struct perf_event *event)
>  static bool is_available_metric_event(struct perf_event *event)
>  {
>  	return is_metric_event(event) &&
> -		event->attr.config <= INTEL_TD_METRIC_AVAILABLE_MAX;
> +	       (event->attr.config & INTEL_ARCH_EVENT_MASK) <= INTEL_TD_METRIC_AVAILABLE_MAX;
>  }
>  
>  static inline bool is_mem_loads_event(struct perf_event *event)