[PATCH 1/2] perf: Fix null pointer access in is_include_guest_event()

[PATCH 1/2] perf: Fix null pointer access in is_include_guest_event()

[Vinay Belgaumkar]

A typical module unload occurring event when there is an active perf
connection leads to freeing of the pmu pointer. The call log is something
like:
 ..
 __pmu_detach_event
 pmu_detach_event
 pmu_detach_events
 perf_pmu_unregister
 ..

__pmu_detach_event() sets event->pmu to null. When the perf connection
finally is closed, the following stack trace is observed:

 Oops: general protection fault, kernel NULL pointer dereference
 ...
 RIP: 0010:_free_event+0x3e/0x370
 ...
 Call Trace:
 ...
 perf_event_release_kernel+0x260/0x2d0
 perf_release+0x12/0x20

A call to mediated_pmu_unaccount_event() inside _free_event() is the root
cause of this crash. Adding a check inside is_include_guest_event() ensures
we don't accidentally access a null pmu ptr. In addition to this, we will
now call mediated_pmu_unaccount_event() before clearing the pmu ptr so that
nr_include_guest_events counts are maintained correctly.

Fixes: eff95e170275 ("perf: Add APIs to create/release mediated guest vPMUs")
Cc: Alexander Kanevskiy <alexander.kanevskiy@intel.com>
Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Assisted-by: Claude:Claude-Sonnet-5
Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
---
 kernel/events/core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index a6c8e38a3110..7777e82aad5e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6350,6 +6350,9 @@ static DEFINE_MUTEX(perf_mediated_pmu_mutex);
 /* !exclude_guest event of PMU with PERF_PMU_CAP_MEDIATED_VPMU */
 static inline bool is_include_guest_event(struct perf_event *event)
 {
+	if (!event->pmu)
+		return false;
+
 	if ((event->pmu->capabilities & PERF_PMU_CAP_MEDIATED_VPMU) &&
 	    !event->attr.exclude_guest)
 		return true;
@@ -13002,6 +13005,7 @@ static void __pmu_detach_event(struct pmu *pmu, struct perf_event *event,
 	exclusive_event_destroy(event);
 	module_put(pmu->module);
 
+	mediated_pmu_unaccount_event(event);
 	event->pmu = NULL; /* force fault instead of UAF */
 }
 
-- 
2.38.1

[PATCH 2/2] perf: Add checks to prevent null ptr access

[Vinay Belgaumkar]

Sashiko recommended some additional checks to prevent null pointer
access. Check for revoked states inside perf_event_read_local(), as
the pmu event may have already been freed at this point. Add a null
check inside __perf_event_read_cpu() as well before accessing the pmu
ptr.

Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
---
 kernel/events/core.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7777e82aad5e..059f82f0cadd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4788,14 +4788,19 @@ static inline const struct cpumask *perf_scope_cpu_topology_cpumask(unsigned int
 
 static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
 {
+	struct pmu *pmu = READ_ONCE(event->pmu);
 	int local_cpu = smp_processor_id();
 	u16 local_pkg, event_pkg;
 
 	if ((unsigned)event_cpu >= nr_cpu_ids)
 		return event_cpu;
 
+	if (!pmu)
+		return -ENODEV;
+
 	if (event->group_caps & PERF_EV_CAP_READ_SCOPE) {
-		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(event->pmu->scope, event_cpu);
+		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(pmu->scope,
+										event_cpu);
 
 		if (cpumask && cpumask_test_cpu(local_cpu, cpumask))
 			return local_cpu;
@@ -4917,6 +4922,11 @@ int perf_event_read_local(struct perf_event *event, u64 *value,
 		goto out;
 	}
 
+	if (READ_ONCE(event->state) <= PERF_EVENT_STATE_REVOKED) {
+		ret = -ENODEV;
+		goto out;
+	}
+
 	/*
 	 * Get the event CPU numbers, and adjust them to local if the event is
 	 * a per-package event that can be read locally
-- 
2.38.1

Re: [PATCH 1/2] perf: Fix null pointer access in is_include_guest_event()

[Mi, Dapeng]

LGTM. Thanks.

Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>

On 9/5/2026 2:16 AM, Vinay Belgaumkar wrote:
> A typical module unload occurring event when there is an active perf
> connection leads to freeing of the pmu pointer. The call log is something
> like:
>  ..
>  __pmu_detach_event
>  pmu_detach_event
>  pmu_detach_events
>  perf_pmu_unregister
>  ..
>
> __pmu_detach_event() sets event->pmu to null. When the perf connection
> finally is closed, the following stack trace is observed:
>
>  Oops: general protection fault, kernel NULL pointer dereference
>  ...
>  RIP: 0010:_free_event+0x3e/0x370
>  ...
>  Call Trace:
>  ...
>  perf_event_release_kernel+0x260/0x2d0
>  perf_release+0x12/0x20
>
> A call to mediated_pmu_unaccount_event() inside _free_event() is the root
> cause of this crash. Adding a check inside is_include_guest_event() ensures
> we don't accidentally access a null pmu ptr. In addition to this, we will
> now call mediated_pmu_unaccount_event() before clearing the pmu ptr so that
> nr_include_guest_events counts are maintained correctly.
>
> Fixes: eff95e170275 ("perf: Add APIs to create/release mediated guest vPMUs")
> Cc: Alexander Kanevskiy <alexander.kanevskiy@intel.com>
> Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
> Assisted-by: Claude:Claude-Sonnet-5
> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
> ---
>  kernel/events/core.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index a6c8e38a3110..7777e82aad5e 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -6350,6 +6350,9 @@ static DEFINE_MUTEX(perf_mediated_pmu_mutex);
>  /* !exclude_guest event of PMU with PERF_PMU_CAP_MEDIATED_VPMU */
>  static inline bool is_include_guest_event(struct perf_event *event)
>  {
> +	if (!event->pmu)
> +		return false;
> +
>  	if ((event->pmu->capabilities & PERF_PMU_CAP_MEDIATED_VPMU) &&
>  	    !event->attr.exclude_guest)
>  		return true;
> @@ -13002,6 +13005,7 @@ static void __pmu_detach_event(struct pmu *pmu, struct perf_event *event,
>  	exclusive_event_destroy(event);
>  	module_put(pmu->module);
>  
> +	mediated_pmu_unaccount_event(event);
>  	event->pmu = NULL; /* force fault instead of UAF */
>  }
>  

Re: [PATCH 2/2] perf: Add checks to prevent null ptr access

[Mi, Dapeng]

On 9/5/2026 2:16 AM, Vinay Belgaumkar wrote:
> Sashiko recommended some additional checks to prevent null pointer
> access. Check for revoked states inside perf_event_read_local(), as
> the pmu event may have already been freed at this point. Add a null

Could you please show where perf_event_read_local() could be called after
the event is revoked?

BTW, the prefix should be "perf/core:" instead of "perf:" by following
current naming convention.

Thanks.


> check inside __perf_event_read_cpu() as well before accessing the pmu
> ptr.
>
> Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
> ---
>  kernel/events/core.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 7777e82aad5e..059f82f0cadd 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -4788,14 +4788,19 @@ static inline const struct cpumask *perf_scope_cpu_topology_cpumask(unsigned int
>  
>  static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
>  {
> +	struct pmu *pmu = READ_ONCE(event->pmu);
>  	int local_cpu = smp_processor_id();
>  	u16 local_pkg, event_pkg;
>  
>  	if ((unsigned)event_cpu >= nr_cpu_ids)
>  		return event_cpu;
>  
> +	if (!pmu)
> +		return -ENODEV;
> +
>  	if (event->group_caps & PERF_EV_CAP_READ_SCOPE) {
> -		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(event->pmu->scope, event_cpu);
> +		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(pmu->scope,
> +										event_cpu);
>  
>  		if (cpumask && cpumask_test_cpu(local_cpu, cpumask))
>  			return local_cpu;
> @@ -4917,6 +4922,11 @@ int perf_event_read_local(struct perf_event *event, u64 *value,
>  		goto out;
>  	}
>  
> +	if (READ_ONCE(event->state) <= PERF_EVENT_STATE_REVOKED) {
> +		ret = -ENODEV;
> +		goto out;
> +	}
> +
>  	/*
>  	 * Get the event CPU numbers, and adjust them to local if the event is
>  	 * a per-package event that can be read locally

Re: [PATCH 2/2] perf: Add checks to prevent null ptr access

[Belgaumkar, Vinay]

On 9/15/2026 6:40 PM, Mi, Dapeng wrote:
> On 9/5/2026 2:16 AM, Vinay Belgaumkar wrote:
>> Sashiko recommended some additional checks to prevent null pointer
>> access. Check for revoked states inside perf_event_read_local(), as
>> the pmu event may have already been freed at this point. Add a null
> Could you please show where perf_event_read_local() could be called after
> the event is revoked?

perf_event_read_local() is only available to be called in the kernel 
context. So, BPF helpers can call it. This was the scenario outlined by 
Sashiko:

If CPU A calls perf_event_read_local(), disables interrupts, and locklessly
checks event->state, it can pass if the event state is
PERF_EVENT_STATE_INACTIVE.

Concurrently, if CPU B calls perf_pmu_unregister() which leads to
__pmu_detach_event(), it will not send an IPI to synchronize with CPU A
since the event is inactive. CPU B then sets event->state to
PERF_EVENT_STATE_REVOKED and clears event->pmu to NULL.

When CPU A continues and calls __perf_event_read_cpu(event, event->cpu),
if the event has PERF_EV_CAP_READ_SCOPE, it will dereference
event->pmu->scope, which was just set to NULL by CPU B, causing a panic.

So, I think the scenario is- we have a regular perf session ongoing and 
a parallel session (through BPF) that tries to access the same counter.

>
> BTW, the prefix should be "perf/core:" instead of "perf:" by following
> current naming convention.

Sure.

Thanks,

Vinay.

>
> Thanks.
>
>
>> check inside __perf_event_read_cpu() as well before accessing the pmu
>> ptr.
>>
>> Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
>> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
>> ---
>>   kernel/events/core.c | 12 +++++++++++-
>>   1 file changed, 11 insertions(+), 1 deletion(-)
>>
>> diff --git a/kernel/events/core.c b/kernel/events/core.c
>> index 7777e82aad5e..059f82f0cadd 100644
>> --- a/kernel/events/core.c
>> +++ b/kernel/events/core.c
>> @@ -4788,14 +4788,19 @@ static inline const struct cpumask *perf_scope_cpu_topology_cpumask(unsigned int
>>   
>>   static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
>>   {
>> +	struct pmu *pmu = READ_ONCE(event->pmu);
>>   	int local_cpu = smp_processor_id();
>>   	u16 local_pkg, event_pkg;
>>   
>>   	if ((unsigned)event_cpu >= nr_cpu_ids)
>>   		return event_cpu;
>>   
>> +	if (!pmu)
>> +		return -ENODEV;
>> +
>>   	if (event->group_caps & PERF_EV_CAP_READ_SCOPE) {
>> -		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(event->pmu->scope, event_cpu);
>> +		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(pmu->scope,
>> +										event_cpu);
>>   
>>   		if (cpumask && cpumask_test_cpu(local_cpu, cpumask))
>>   			return local_cpu;
>> @@ -4917,6 +4922,11 @@ int perf_event_read_local(struct perf_event *event, u64 *value,
>>   		goto out;
>>   	}
>>   
>> +	if (READ_ONCE(event->state) <= PERF_EVENT_STATE_REVOKED) {
>> +		ret = -ENODEV;
>> +		goto out;
>> +	}
>> +
>>   	/*
>>   	 * Get the event CPU numbers, and adjust them to local if the event is
>>   	 * a per-package event that can be read locally

Re: [PATCH 2/2] perf: Add checks to prevent null ptr access

[Mi, Dapeng]

On 9/17/2026 5:48 AM, Belgaumkar, Vinay wrote:
> On 9/15/2026 6:40 PM, Mi, Dapeng wrote:
>> On 9/5/2026 2:16 AM, Vinay Belgaumkar wrote:
>>> Sashiko recommended some additional checks to prevent null pointer
>>> access. Check for revoked states inside perf_event_read_local(), as
>>> the pmu event may have already been freed at this point. Add a null
>> Could you please show where perf_event_read_local() could be called after
>> the event is revoked?
> perf_event_read_local() is only available to be called in the kernel 
> context. So, BPF helpers can call it. This was the scenario outlined by 
> Sashiko:
>
> If CPU A calls perf_event_read_local(), disables interrupts, and locklessly
> checks event->state, it can pass if the event state is
> PERF_EVENT_STATE_INACTIVE.
>
> Concurrently, if CPU B calls perf_pmu_unregister() which leads to
> __pmu_detach_event(), it will not send an IPI to synchronize with CPU A
> since the event is inactive. CPU B then sets event->state to
> PERF_EVENT_STATE_REVOKED and clears event->pmu to NULL.
>
> When CPU A continues and calls __perf_event_read_cpu(event, event->cpu),
> if the event has PERF_EV_CAP_READ_SCOPE, it will dereference
> event->pmu->scope, which was just set to NULL by CPU B, causing a panic.

Ok, better add this into the change log, so the reviewers know why we need
this change. Thanks.


>
> So, I think the scenario is- we have a regular perf session ongoing and 
> a parallel session (through BPF) that tries to access the same counter.
>
>> BTW, the prefix should be "perf/core:" instead of "perf:" by following
>> current naming convention.
> Sure.
>
> Thanks,
>
> Vinay.
>
>> Thanks.
>>
>>
>>> check inside __perf_event_read_cpu() as well before accessing the pmu
>>> ptr.
>>>
>>> Cc: Dapeng Mi <dapeng1.mi@linux.intel.com>
>>> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
>>> ---
>>>   kernel/events/core.c | 12 +++++++++++-
>>>   1 file changed, 11 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/kernel/events/core.c b/kernel/events/core.c
>>> index 7777e82aad5e..059f82f0cadd 100644
>>> --- a/kernel/events/core.c
>>> +++ b/kernel/events/core.c
>>> @@ -4788,14 +4788,19 @@ static inline const struct cpumask *perf_scope_cpu_topology_cpumask(unsigned int
>>>   
>>>   static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
>>>   {
>>> +	struct pmu *pmu = READ_ONCE(event->pmu);
>>>   	int local_cpu = smp_processor_id();
>>>   	u16 local_pkg, event_pkg;
>>>   
>>>   	if ((unsigned)event_cpu >= nr_cpu_ids)
>>>   		return event_cpu;
>>>   
>>> +	if (!pmu)
>>> +		return -ENODEV;
>>> +
>>>   	if (event->group_caps & PERF_EV_CAP_READ_SCOPE) {
>>> -		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(event->pmu->scope, event_cpu);
>>> +		const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(pmu->scope,
>>> +										event_cpu);
>>>   
>>>   		if (cpumask && cpumask_test_cpu(local_cpu, cpumask))
>>>   			return local_cpu;
>>> @@ -4917,6 +4922,11 @@ int perf_event_read_local(struct perf_event *event, u64 *value,
>>>   		goto out;
>>>   	}
>>>   
>>> +	if (READ_ONCE(event->state) <= PERF_EVENT_STATE_REVOKED) {
>>> +		ret = -ENODEV;
>>> +		goto out;
>>> +	}
>>> +
>>>   	/*
>>>   	 * Get the event CPU numbers, and adjust them to local if the event is
>>>   	 * a per-package event that can be read locally