[PATCH] perf/x86: Prevent NULL event deref in handle_pmi_common()

[PATCH] perf/x86: Prevent NULL event deref in handle_pmi_common()

[evan.li]

From: Evan Li <evan.li@linux.alibaba.com>

handle_pmi_common() may observe an active bit set in cpuc->active_mask
while the corresponding cpuc->events[] entry has already been cleared,
which leads to a NULL pointer dereference.

This can happen when interrupt throttling stops all events in a group
while PEBS processing is still in progress. perf_event_overflow() can
trigger perf_event_throttle_group(), which stops the group and clears
the cpuc->events[] entry, but the active bit may still be set when
handle_pmi_common() iterates over the events.

The following change:

7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")

moved cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and
relied on cpuc->active_mask/pebs_enabled checks. However,
handle_pmi_common() can still encounter a NULL cpuc->events[] entry
despite the active bit being set.

Add an explicit NULL check on the event pointer before using it to
avoid dereferencing a cleared cpuc->events[] slot.

Fixes: 7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")
Reported-by: kitta <kitta@linux.alibaba.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220855
Co-developed-by: kitta <kitta@linux.alibaba.com>
Signed-off-by: Evan Li <evan.li@linux.alibaba.com>
---
 arch/x86/events/intel/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 853fe073b..a7454ed6a 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3378,6 +3378,9 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status)
 
 		if (!test_bit(bit, cpuc->active_mask))
 			continue;
+		/* Check if event is NULL to prevent null pointer dereference */
+		if (!event)
+			continue;
 
 		/*
 		 * There may be unprocessed PEBS records in the PEBS buffer,
-- 
2.43.7

Re: [PATCH] perf/x86: Prevent NULL event deref in handle_pmi_common()

[Peter Zijlstra]

On Fri, Dec 12, 2025 at 04:49:43PM +0800, evan.li@linux.alibaba.com wrote:
> From: Evan Li <evan.li@linux.alibaba.com>
> 
> handle_pmi_common() may observe an active bit set in cpuc->active_mask
> while the corresponding cpuc->events[] entry has already been cleared,
> which leads to a NULL pointer dereference.
> 
> This can happen when interrupt throttling stops all events in a group
> while PEBS processing is still in progress. perf_event_overflow() can
> trigger perf_event_throttle_group(), which stops the group and clears
> the cpuc->events[] entry, but the active bit may still be set when
> handle_pmi_common() iterates over the events.
> 
> The following change:
> 
> 7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")
> 
> moved cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and
> relied on cpuc->active_mask/pebs_enabled checks. However,
> handle_pmi_common() can still encounter a NULL cpuc->events[] entry
> despite the active bit being set.

How? What is doing del() concurrently with the pmi?

Re: [PATCH] perf/x86: Prevent NULL event deref in handle_pmi_common()

[Mi, Dapeng]

On 12/12/2025 6:44 PM, Peter Zijlstra wrote:
> On Fri, Dec 12, 2025 at 04:49:43PM +0800, evan.li@linux.alibaba.com wrote:
>> From: Evan Li <evan.li@linux.alibaba.com>
>>
>> handle_pmi_common() may observe an active bit set in cpuc->active_mask
>> while the corresponding cpuc->events[] entry has already been cleared,
>> which leads to a NULL pointer dereference.
>>
>> This can happen when interrupt throttling stops all events in a group
>> while PEBS processing is still in progress. perf_event_overflow() can
>> trigger perf_event_throttle_group(), which stops the group and clears
>> the cpuc->events[] entry, but the active bit may still be set when
>> handle_pmi_common() iterates over the events.
>>
>> The following change:
>>
>> 7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")
>>
>> moved cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and
>> relied on cpuc->active_mask/pebs_enabled checks. However,
>> handle_pmi_common() can still encounter a NULL cpuc->events[] entry
>> despite the active bit being set.
> How? What is doing del() concurrently with the pmi?

As long as stop() is called before del(), the corresponding bit in
active_mask should be cleared. Perhaps it's because x86_pmu_start() is
called first and x86_pmu_enable() is still not called and PMI arrives? 
Anyway I can't figure out why this issue could happen. @kitta @evan could
you please share how to reproduce this issue? I would try to reproduce this
issue locally. Thanks.


>