Re: [PATCH] s390/pai: Handle multiple PMU stop callback invocations

[Heiko Carstens <hca@linux.ibm.com>]

On Thu, Aug 13, 2026 at 11:33:59AM +0200, Thomas Richter wrote:
> On 8/13/26 09:21, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > 
> > Pre-existing issues:
> > - [High] Unsafe iteration over `cpump->syswide_list` in `pai_have_samples()` leads to a kernel crash (LIST_POISON dereference) if an event overflows and is synchronously throttled during the loop.
> > --
> 
> This can not happen. The syswide_list is anchored by per-CPU pai_map::syswide_list and tracks
> all events which are bound to that particular CPU. The event was installed only on that particular
> CPU and does not move with the process/task. Each CPU has its own list anchored by
>  pai_map::syswide_list.
> 
> The call chains are either
> 
>  paicrypt_sched_task() or paiext_sched_task
>  +--> pai_have_samples() iterates over syswide_list and calls
>       +--> pai_have_sample
...
>  I think this is safe or am I mistaken?

Looks like this is not safe. The following can happen:

-> pai_have_sample()
 -> pai_push_sample()
  -> perf_event_overflow()
   -> event->pmu->stop()
    -> pai_stop()
     -> list_del() modifies the list being traversed
      -> potential crash when list traversal continues

As sashiko proposed: using list_for_each_entry_safe() instead of
list_for_each_entry() would avoid that potential scenario.