Re: [Patch v3 1/8] perf/x86: Unregister PMI handler on PMU init failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing Use-After-Free window for `cpuc->pmu` if `perf_pmu_register()` fails on hybrid systems.
--

--- Patch [1]: [Patch v3 1/8] perf/x86: Unregister PMI handler on PMU init failure ---
commit 841a0ed2adb8a95774faf3b5508e90fdd97d9135
Author: Dapeng Mi <dapeng1.mi@linux.intel.com>

perf/x86: Unregister PMI handler on PMU init failure

This commit fixes an NMI handler leak in init_hw_perf_events() by unregistering
the NMI handler when PMU initialization fails before clearing the x86_pmu state.

> diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
> index af0b67ffb43d8..872d07a5fa80d 100644
> --- a/arch/x86/events/core.c
> +++ b/arch/x86/events/core.c
[ ... ]
> @@ -2273,6 +2273,8 @@ static int __init init_hw_perf_events(void)
>  	cpuhp_remove_state(CPUHP_AP_PERF_X86_STARTING);
>  out:
>  	cpuhp_remove_state(CPUHP_PERF_X86_PREPARE);
> +pmi_unregister:
> +	unregister_nmi_handler(NMI_LOCAL, "PMI");
>  out_bad_pmu:

[Severity: High]
This is a pre-existing issue, but does this error path leave a dangling
pointer that could lead to a Use-After-Free?

On hybrid systems, if perf_pmu_register() fails, the error path frees the
x86_pmu.hybrid_pmu structures. However, CPUHP_AP_PERF_X86_STARTING was already
set up, so cpuc->pmu on all online CPUs was initialized to point to these
now-freed structures.

The CPU hotplug state rollback doesn't set cpuc->pmu back to NULL. Since
x86_pmu_static_call_update() has already routed x86_pmu_guest_get_msrs to
intel_guest_get_msrs(), and the perf_is_hybrid static key remains enabled,
could a subsequent KVM guest launch trigger a UAF?

When KVM calls perf_guest_get_msrs(), it jumps to intel_guest_get_msrs(),
which unconditionally dereferences the dangling cpuc->pmu pointer:

arch/x86/events/intel/core.c:intel_guest_get_msrs() {
    ...
    u64 intel_ctrl = hybrid(cpuc->pmu, intel_ctrl);
    ...
}

>  	memset(&x86_pmu, 0, sizeof(x86_pmu));
>  	return err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717080342.1879573-1-dapeng1.mi@linux.intel.com?part=1