Re: [Patch v2 9/9] perf/core: Check kernel access when kernel callchains are requested

["Mi, Dapeng" <dapeng1.mi@linux.intel.com>]

On 6/9/2026 1:24 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] The patch breaks `perf record -g` for unprivileged users with existing `perf` binaries.
> --
>
> commit ac223ffdf5e79c1aa96a91deecdff94004bbe30f
> Author: Dapeng Mi <dapeng1.mi@linux.intel.com>
>
> perf/core: Check kernel access when kernel callchains are requested
>
> This commit updates perf_event_open to verify kernel access permissions
> when kernel callchains are requested, even if exclude_kernel is set.
> This is intended to prevent unprivileged capture of kernel callchains.
>
>> diff --git a/kernel/events/core.c b/kernel/events/core.c
>> --- a/kernel/events/core.c
>> +++ b/kernel/events/core.c
> [ ... ]
>> @@ -13904,7 +13904,9 @@ SYSCALL_DEFINE5(perf_event_open,
>>  	if (err)
>>  		return err;
>>  
>> -	if (!attr.exclude_kernel) {
>> +	if (!attr.exclude_kernel ||
>> +	    ((attr.sample_type & PERF_SAMPLE_CALLCHAIN) &&
>> +	     !attr.exclude_callchain_kernel)) {
>>  		err = perf_allow_kernel();
> [Severity: Critical]
> Does this change break perf record -g for unprivileged users using
> existing perf binaries?
>
> When an unprivileged user runs perf record -g, the initial syscall
> request fails with -EACCES. The perf tool's existing fallback logic
> retries by setting exclude_kernel = 1, but it leaves
> exclude_callchain_kernel = 0.
>
> Because this new check enforces the privilege requirement for callchains
> even when exclude_kernel is set, the retried syscall will fail a second
> time with -EACCES.
>
> Looking at the perf tool's fallback handler:
>
> tools/perf/util/evsel.c:evsel__fallback() {
>     ...
> 	} else if (err == EACCES && !evsel->core.attr.exclude_kernel &&
> 		   (paranoid = perf_event_paranoid()) > 1) {
>     ...
> }
>
> Since exclude_kernel was set to 1 during the first fallback, the tool
> cannot handle the second -EACCES failure. Will this cause the tool to
> abort entirely with a permission denied error rather than falling back
> to user-only callchains?

Yes, this is the expected behavior, we need the similar fallback for
exclude_callchain_kernel attribute. The perf tools patch would be posted
separately.

Thanks.


>