From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F4078C624D4 for ; Wed, 2 Sep 2026 15:54:17 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 349AC10F2A3; Wed, 2 Sep 2026 15:54:17 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="IVYTh2fz"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.16]) by gabe.freedesktop.org (Postfix) with ESMTPS id 321FE10E517; Wed, 2 Sep 2026 15:54:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1788364456; x=1819900456; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=YN4EJ4px2KICrrwv4lTLG4gWDV+gmZkGd3lnkmGYvjc=; b=IVYTh2fztiqeC6on1MUkf6udv8MvXGYEYrPA47A2buOIxnvbNozSktdQ p4a2jfTNSeBRG2hl16daO2a4r+0bQYvCsk1F29e7l2M6nljO04538bW7c m5GyEyMC9Zjo9O0ZhvbwPLWPBM9xDtUGHIcBN7Oa083ErzGYglh4ZPAhz Sv5gAR+LO0aMcTeKbG80ydqMyShzk+N/2SPaog1QHJ5YM8ECfuf8ReiKW Ll1FxpKPwxFPSJjkmfQ5u5wCjIREpX+F4JjdSSg8RhIudPjwf53F69pc7 Ksj/hNUEtjU9iAl67reXsOc5e2SvV3NbjhK3IRdsJtvAtVFw/guZhr9dQ w==; X-CSE-ConnectionGUID: ybaiMV7DRdu07t62GFGhJA== X-CSE-MsgGUID: hUikE9ArSN6GS2w3tRL7Xg== X-IronPort-AV: E=McAfee;i="6800,10657,11894"; a="76380003" X-IronPort-AV: E=Sophos;i="6.25,258,1779174000"; d="scan'208";a="76380003" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Sep 2026 08:54:16 -0700 X-CSE-ConnectionGUID: DEqyJg5HQ36i4X8PYfyzAw== X-CSE-MsgGUID: QUSLTSFjT1uI466vGL0wqA== X-ExtLoop1: 1 Received: from vbelgaum-ubuntu.fm.intel.com ([10.1.39.16]) by fmviesa003.fm.intel.com with ESMTP; 02 Sep 2026 08:54:16 -0700 From: Vinay Belgaumkar To: intel-xe@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org, Vinay Belgaumkar , Dapeng Mi Subject: [PATCH v7 2/2] perf: Add checks to prevent null ptr access Date: Wed, 2 Sep 2026 08:48:52 -0700 Message-Id: <20260902154852.742844-3-vinay.belgaumkar@intel.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20260902154852.742844-1-vinay.belgaumkar@intel.com> References: <20260902154852.742844-1-vinay.belgaumkar@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: intel-xe@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Xe graphics driver List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-xe-bounces@lists.freedesktop.org Sender: "Intel-xe" Sashiko recommended some additional checks to prevent null pointer access. Check for revoked states inside perf_event_read_local(), as the pmu event may have already been freed at this point. Add a null check inside __perf_event_read_cpu() as well before accessing the pmu ptr. Cc: Dapeng Mi Signed-off-by: Vinay Belgaumkar --- kernel/events/core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index f19d27ac411d..bb90034a2054 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -4788,14 +4788,19 @@ static inline const struct cpumask *perf_scope_cpu_topology_cpumask(unsigned int static int __perf_event_read_cpu(struct perf_event *event, int event_cpu) { + struct pmu *pmu = READ_ONCE(event->pmu); int local_cpu = smp_processor_id(); u16 local_pkg, event_pkg; if ((unsigned)event_cpu >= nr_cpu_ids) return event_cpu; + if (!pmu) + return -ENODEV; + if (event->group_caps & PERF_EV_CAP_READ_SCOPE) { - const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(event->pmu->scope, event_cpu); + const struct cpumask *cpumask = perf_scope_cpu_topology_cpumask(pmu->scope, + event_cpu); if (cpumask && cpumask_test_cpu(local_cpu, cpumask)) return local_cpu; @@ -4917,6 +4922,11 @@ int perf_event_read_local(struct perf_event *event, u64 *value, goto out; } + if (READ_ONCE(event->state) <= PERF_EVENT_STATE_REVOKED) { + ret = -ENODEV; + goto out; + } + /* * Get the event CPU numbers, and adjust them to local if the event is * a per-package event that can be read locally -- 2.38.1