Re: [Patch v2 9/9] perf/core: Check kernel access when kernel callchains are requested

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The patch breaks `perf record -g` for unprivileged users with existing `perf` binaries.
--

commit ac223ffdf5e79c1aa96a91deecdff94004bbe30f
Author: Dapeng Mi <dapeng1.mi@linux.intel.com>

perf/core: Check kernel access when kernel callchains are requested

This commit updates perf_event_open to verify kernel access permissions
when kernel callchains are requested, even if exclude_kernel is set.
This is intended to prevent unprivileged capture of kernel callchains.

> diff --git a/kernel/events/core.c b/kernel/events/core.c
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
[ ... ]
> @@ -13904,7 +13904,9 @@ SYSCALL_DEFINE5(perf_event_open,
>  	if (err)
>  		return err;
>  
> -	if (!attr.exclude_kernel) {
> +	if (!attr.exclude_kernel ||
> +	    ((attr.sample_type & PERF_SAMPLE_CALLCHAIN) &&
> +	     !attr.exclude_callchain_kernel)) {
>  		err = perf_allow_kernel();

[Severity: Critical]
Does this change break perf record -g for unprivileged users using
existing perf binaries?

When an unprivileged user runs perf record -g, the initial syscall
request fails with -EACCES. The perf tool's existing fallback logic
retries by setting exclude_kernel = 1, but it leaves
exclude_callchain_kernel = 0.

Because this new check enforces the privilege requirement for callchains
even when exclude_kernel is set, the retried syscall will fail a second
time with -EACCES.

Looking at the perf tool's fallback handler:

tools/perf/util/evsel.c:evsel__fallback() {
    ...
	} else if (err == EACCES && !evsel->core.attr.exclude_kernel &&
		   (paranoid = perf_event_paranoid()) > 1) {
    ...
}

Since exclude_kernel was set to 1 during the first fallback, the tool
cannot handle the second -EACCES failure. Will this cause the tool to
abort entirely with a permission denied error rather than falling back
to user-only callchains?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609050222.2458129-1-dapeng1.mi@linux.intel.com?part=9