Re: [PATCH] perf/core: Handling the race between exit_mmap and perf sample

[Peter Zijlstra <peterz@infradead.org>]

On Wed, Jun 04, 2025 at 03:55:01PM +0100, Mark Rutland wrote:

> I think we might need something in the perf core for cpu-bound events, assuming
> those can also potentially make samples.
> 
> From a quick scan of perf_event_sample_format:
> 
> 	PERF_SAMPLE_IP			// safe
> 	PERF_SAMPLE_TID			// safe
> 	PERF_SAMPLE_TIME		// safe
> 	PERF_SAMPLE_ADDR		// ???

Safe, set by driver, or 0.

> 	PERF_SAMPLE_READ		// ???

This is basically read(2) on a fd, but in sample format. Only the count
values. This good.

> 	PERF_SAMPLE_CALLCHAIN		// may access mm

Right.

> 	PERF_SAMPLE_ID			// safe
> 	PERF_SAMPLE_CPU			// safe
> 	PERF_SAMPLE_PERIOD		// safe
> 	PERF_SAMPLE_STREAM_ID		// ???
safe

> 	PERF_SAMPLE_RAW			// ???
safe, this is random data returned by the driver

> 	PERF_SAMPLE_BRANCH_STACK	// safe
> 	PERF_SAMPLE_REGS_USER		// safe
> 	PERF_SAMPLE_STACK_USER		// may access mm
> 	PERF_SAMPLE_WEIGHT		// ???
> 	PERF_SAMPLE_DATA_SRC		// ???
Both should be safe, driver sets them.

> 	PERF_SAMPLE_IDENTIFIER		// safe
> 	PERF_SAMPLE_TRANSACTION		// ???
Safe, another random thing the driver can set. This was for
transactional memory stuff.

> 	PERF_SAMPLE_REGS_INTR		// safe
> 	PERF_SAMPLE_PHYS_ADDR		// safe; handles mm==NULL && addr < TASK_SIZE
> 	PERF_SAMPLE_AUX			// ???

Safe, should be driver, PT for Intel, or that CoreSight for ARM.

> 	PERF_SAMPLE_CGROUP		// safe
> 	PERF_SAMPLE_DATA_PAGE_SIZE	// partial; doesn't check addr < TASK_SIZE
> 	PERF_SAMPLE_CODE_PAGE_SIZE	// partial; doesn't check addr < TASK_SIZE

But does use init_mm when !mm, perf_get_page_size().

> 	PERF_SAMPLE_WEIGHT_STRUCT	// ???
Safe, driver bits again.

> 
> ... I think all the dodgy cases use mm somehow, so maybe the perf core
> should check for current->mm?

This then... I suppose.

---
diff --git a/kernel/events/core.c b/kernel/events/core.c
index f34c99f8ce8f..49944e4ec3e7 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7439,6 +7439,10 @@ perf_sample_ustack_size(u16 stack_size, u16 header_size,
 	if (!regs)
 		return 0;
 
+	/* No mm, no stack, no dump. */
+	if (!current->mm)
+		return 0;
+
 	/*
 	 * Check if we fit in with the requested stack size into the:
 	 * - TASK_SIZE
@@ -8153,6 +8157,9 @@ perf_callchain(struct perf_event *event, struct pt_regs *regs)
 	if (!kernel && !user)
 		return &__empty_callchain;
 
+	if (!current->mm)
+		user = false;
+
 	callchain = get_perf_callchain(regs, 0, kernel, user,
 				       max_stack, crosstask, true);
 	return callchain ?: &__empty_callchain;