Re: [PATCH] perf evsel: Skip group members without fds when walking a group

[Namhyung Kim <namhyung@kernel.org>]

Hello,

On Fri, Oct 23, 2026 at 08:56:29AM +0000, TAKANO Mitsuhiro wrote:
> A group led by a userspace PMU event and containing kernel events is
> opened with group_fd = -1 for the members, because the kernel cannot
> group a userspace PMU with a kernel one.  The members are therefore
> enabled from userspace when the leader is enabled, but their fd array is
> not set up in that case, so perf_evsel__enable_cpu() dereferences a NULL
> pointer:
> 
>   $ perf stat -a -e '{user_time,cycles}' -- sleep 0.05
>   Segmentation fault
> 
>   $ perf stat -a -e '{system_time,cycles}' -- sleep 0.05
>   Segmentation fault
> 
> Only the leaders of such a group are opened with an fd in this path.
> Skip the members that have no fd, the same way __evlist__enable() skips
> leaders without one, in the four loops that walk the members of a group.
> 
> Verified on an Ampere Altra (arm64, Neoverse-N1) with a perf built from
> this tree: the two commands above segfault before the change and print
> user_time/system_time after it, while plain groups such as
> '{cycles,instructions}', 'perf stat' with no event and '-r 2' are
> unchanged.
> 
> Fixes: 0b18bced5444 ("perf tool_pmu: Make tool PMU events respect enable/disable")
> Assisted-by: LLM
> Signed-off-by: TAKANO Mitsuhiro <takano32@gmail.com>
> ---

Sorry for the delay, but it seems easier to fix the fd handling in
libperf like this (not tested).

Thanks,
Namhyung


diff --git a/tools/lib/perf/evsel.c b/tools/lib/perf/evsel.c
index f747c0bc692d8a61..43ea1dfcebf421e5 100644
--- a/tools/lib/perf/evsel.c
+++ b/tools/lib/perf/evsel.c
@@ -57,7 +57,7 @@ void perf_evsel__delete(struct perf_evsel *evsel)
 }

 #define FD(_evsel, _cpu_map_idx, _thread)                              \
-       ((int *)xyarray__entry(_evsel->fd, _cpu_map_idx, _thread))
+       (_evsel->fd ? (int *)xyarray__entry(_evsel->fd, _cpu_map_idx, _thread) : NULL)
 #define MMAP(_evsel, _cpu_map_idx, _thread)                            \
        (_evsel->mmap ? ((struct perf_mmap *) xyarray__entry(_evsel->mmap, _cpu_map_idx, _thread)) \
                      : NULL)