Re: [PATCH] s390/pai: Reduce excessive debug feature size

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing CPU hotplug handling causes uninitialized per-CPU pointers to be dereferenced when task-bound perf events migrate to newly onlined CPUs.
--

--- Patch [1]: [PATCH] s390/pai: Reduce excessive debug feature size ---
commit 07fb6d75462afb53888116fff8b2fe4b2e6d8db6
Author: Heiko Carstens <hca@linux.ibm.com>

s390/pai: Reduce excessive debug feature size

The pai debug feature is registered with 256 areas, where each area
contains 32 pages. This sums up to a total of 32MiB. The code does not use
any debug exceptions, which means that 255 of those areas are never
used.

> diff --git a/arch/s390/kernel/perf_pai.c b/arch/s390/kernel/perf_pai.c
> index cdb8006220ca0..ab76ed7ad791e 100644
> --- a/arch/s390/kernel/perf_pai.c
> +++ b/arch/s390/kernel/perf_pai.c
> @@ -1221,7 +1221,7 @@ static int __init paipmu_setup(void)
>  static int __init pai_init(void)
>  {
>  	/* Setup s390dbf facility */
> -	paidbg = debug_register("pai", 32, 256, 128);
> +	paidbg = debug_register("pai", 1, 1, 128);

[Severity: High]
This is a pre-existing issue, but does the PAI PMU code handle CPU
hotplugging correctly?

If pai_alloc() only allocates PMU tracking structures for currently online
CPUs:

arch/s390/kernel/perf_pai.c:pai_alloc() {
    ...
    for_each_online_cpu(cpu) {
        rc = pai_alloc_cpu(event, cpu);
        if (rc) {
    ...
}

And a task with an active PAI event migrates to a newly onlined CPU where
structures were not allocated, won't mp->mapptr be NULL here:

arch/s390/kernel/perf_pai.c:pai_add() {
    ...
    struct pai_map *cpump = mp->mapptr;
    struct paiext_cb *pcb = cpump->paiext_cb;
    unsigned long ccd;

    if (++cpump->active_events == 1) {
    ...
}

Could this lead to a NULL pointer dereference when accessing
cpump->paiext_cb or cpump->active_events?

>  	if (!paidbg) {
>  		pr_err("Registration of s390dbf pai failed\n");
>  		return -ENOMEM;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825094925.1791807-1-hca@linux.ibm.com?part=1