Re: [PATCH 2/2] perf: Add checks to prevent null ptr access

["Mi, Dapeng" <dapeng1.mi@linux.intel.com>]

On 9/17/2026 5:48 AM, Belgaumkar, Vinay wrote:
> On 9/15/2026 6:40 PM, Mi, Dapeng wrote:
>> On 9/5/2026 2:16 AM, Vinay Belgaumkar wrote:
>>> Sashiko recommended some additional checks to prevent null pointer
>>> access. Check for revoked states inside perf_event_read_local(), as
>>> the pmu event may have already been freed at this point. Add a null
>> Could you please show where perf_event_read_local() could be called after
>> the event is revoked?
> perf_event_read_local() is only available to be called in the kernel 
> context. So, BPF helpers can call it. This was the scenario outlined by 
> Sashiko:
>
> If CPU A calls perf_event_read_local(), disables interrupts, and locklessly
> checks event->state, it can pass if the event state is
> PERF_EVENT_STATE_INACTIVE.
>
> Concurrently, if CPU B calls perf_pmu_unregister() which leads to
> __pmu_detach_event(), it will not send an IPI to synchronize with CPU A
> since the event is inactive. CPU B then sets event->state to
> PERF_EVENT_STATE_REVOKED and clears event->pmu to NULL.
>
> When CPU A continues and calls __perf_event_read_cpu(event, event->cpu),
> if the event has PERF_EV_CAP_READ_SCOPE, it will dereference
> event->pmu->scope, which was just set to NULL by CPU B, causing a panic.

Ok, better add this into the change log, so the reviewers know why we need
this change. Thanks.


>
> So, I think the scenario is- we have a regular perf session ongoing and 
> a parallel session (through BPF) that tries to access the same counter.
>
>> BTW, the prefix should be "perf/core:" instead of "perf:" by following
>> current naming convention.
> Sure.
>
> Thanks,
>
> Vinay.
>
>> Thanks.
>>
>>
>>> check inside __perf_event_read_cpu() as well before accessing the pmu
>>> ptr.
>>>
>>> Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
>>> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
>>> ---
>>>   kernel/events/core.c | 12 +++++++++++-
>>>   1 file changed, 11 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/kernel/events/core.c b/kernel/events/core.c
>>> index 7777e82aad5e..059f82f0cadd 100644
>>> --- a/kernel/events/core.c
>>> +++ b/kernel/events/core.c
>>> @@ -4788,14 +4788,19 @@ static inline const struct cpumask *perf_scope_cpu_topology_cpumask(unsigned int
>>>   
>>>   static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
>>>   {
>>> +	struct pmu *pmu = READ_ONCE(event->pmu);
>>>   	int local_cpu = smp_processor_id();
>>>   	u16 local_pkg, event_pkg;
>>>   
>>>   	if ((unsigned)event_cpu >= nr_cpu_ids)
>>>   		return event_cpu;
>>>   
>>> +	if (!pmu)
>>> +		return -ENODEV;
>>> +
>>>   	if (event->group_caps & PERF_EV_CAP_READ_SCOPE) {
>>> -		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(event->pmu->scope, event_cpu);
>>> +		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(pmu->scope,
>>> +										event_cpu);
>>>   
>>>   		if (cpumask && cpumask_test_cpu(local_cpu, cpumask))
>>>   			return local_cpu;
>>> @@ -4917,6 +4922,11 @@ int perf_event_read_local(struct perf_event *event, u64 *value,
>>>   		goto out;
>>>   	}
>>>   
>>> +	if (READ_ONCE(event->state) <= PERF_EVENT_STATE_REVOKED) {
>>> +		ret = -ENODEV;
>>> +		goto out;
>>> +	}
>>> +
>>>   	/*
>>>   	 * Get the event CPU numbers, and adjust them to local if the event is
>>>   	 * a per-package event that can be read locally