Re: [PATCH v3 1/4] perf/core: Fix NULL pmu_ctx passed to PMU sched_task callback

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] Incomplete Fix / Architectural Regression Masking in __perf_pmu_sched_task()
--

commit f71d68607ec5b88fb13bb33d01fafd22533f428b
Author: Puranjay Mohan <puranjay@kernel.org>

perf/core: Fix NULL pmu_ctx passed to PMU sched_task callback

This commit modifies __perf_pmu_sched_task() to avoid a NULL pointer
dereference when a task has no perf events for a specific PMU. It falls
back to using the CPU context when the task context is NULL, which
prevents crashes when using CPU-wide branch-stack events.

> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 1f5699b339ec8..2a8fb78e13471 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -3906,7 +3906,8 @@ static void __perf_pmu_sched_task(struct perf_cpu_pmu_context *cpc,
>  	perf_ctx_lock(cpuctx, cpuctx->task_ctx);
>  	perf_pmu_disable(pmu);
>  
> -	pmu->sched_task(cpc->task_epc, task, sched_in);
> +	pmu->sched_task(cpc->task_epc ? cpc->task_epc : &cpc->epc,
> +			task, sched_in);

While this prevents the NULL pointer dereference when __perf_pmu_sched_task()
is called, does this fully resolve the issue if the task has an unrelated
perf event?

Looking at the caller perf_pmu_sched_task():

static void perf_pmu_sched_task(struct task_struct *prev,
				struct task_struct *next,
				bool sched_in)
{
	...
	if (prev == next || cpuctx->task_ctx)
		return;
	...
}

If the task has an unrelated event, like a software event, cpuctx->task_ctx
is not NULL, and this returns early.

The fallback path perf_event_context_sched_in/out() calls
perf_ctx_sched_task_cb(), which iterates over ctx->pmu_ctx_list.

Since a PMU with only CPU-wide events is not in ctx->pmu_ctx_list, will this
PMU be silently bypassed?

Could this regression cause branch records to leak across tasks if the
scheduled task has an unrelated perf event?

>  
>  	perf_pmu_enable(pmu);
>  	perf_ctx_unlock(cpuctx, cpuctx->task_ctx);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260413185740.3286146-1-puranjay@kernel.org?part=1