linux-kernel - Re: [PATCH] perf/x86: Prevent NULL event deref in handle_pmi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <defbd409-a3b6-4e12-8070-f9ae9ddeed66@linux.intel.com>
Date: Mon, 15 Dec 2025 15:43:25 +0800
From: "Mi, Dapeng" <dapeng1.mi@...ux.intel.com>
To: Peter Zijlstra <peterz@...radead.org>, evan.li@...ux.alibaba.com
Cc: mingo@...hat.com, acme@...nel.org, namhyung@...nel.org,
 tglx@...utronix.de, bp@...en8.de, dave.hansen@...ux.intel.com,
 linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org,
 kitta <kitta@...ux.alibaba.com>
Subject: Re: [PATCH] perf/x86: Prevent NULL event deref in handle_pmi_common()


On 12/12/2025 6:44 PM, Peter Zijlstra wrote:
> On Fri, Dec 12, 2025 at 04:49:43PM +0800, evan.li@...ux.alibaba.com wrote:
>> From: Evan Li <evan.li@...ux.alibaba.com>
>>
>> handle_pmi_common() may observe an active bit set in cpuc->active_mask
>> while the corresponding cpuc->events[] entry has already been cleared,
>> which leads to a NULL pointer dereference.
>>
>> This can happen when interrupt throttling stops all events in a group
>> while PEBS processing is still in progress. perf_event_overflow() can
>> trigger perf_event_throttle_group(), which stops the group and clears
>> the cpuc->events[] entry, but the active bit may still be set when
>> handle_pmi_common() iterates over the events.
>>
>> The following change:
>>
>> 7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")
>>
>> moved cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and
>> relied on cpuc->active_mask/pebs_enabled checks. However,
>> handle_pmi_common() can still encounter a NULL cpuc->events[] entry
>> despite the active bit being set.
> How? What is doing del() concurrently with the pmi?

As long as stop() is called before del(), the corresponding bit in
active_mask should be cleared. Perhaps it's because x86_pmu_start() is
called first and x86_pmu_enable() is still not called and PMI arrives? 
Anyway I can't figure out why this issue could happen. @kitta @evan could
you please share how to reproduce this issue? I would try to reproduce this
issue locally. Thanks.


>