A kernel panic is observed when an application has a perf connection open
and the driver managing the pmu event unbinds. The issue occurs when
perf_pmu_unregister() is called while there is an active perf session. The
null pointer error is seen when the event is freed through __free_event()
and mediated_pmu_unaccount_event is called. There is a missing null check
inside is_include_guest_event(). Also call mediated_pmu_unaccount_event()
inside __pmu_detach_event() similar to __free_event().
v2: Add another check to prevent null access (sashiko)
Fixes: eff95e170275 ("perf: Add APIs to create/release mediated guest vPMUs")
Cc: Alexander Kanevskiy <[email protected]>
Assisted-by: Claude:Claude-Sonnet-5
Signed-off-by: Vinay Belgaumkar <[email protected]>
---
kernel/events/core.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 94ca277e0819..88e0d5e476a8 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4917,6 +4917,11 @@ int perf_event_read_local(struct perf_event *event, u64
*value,
goto out;
}
+ if (event->state <= PERF_EVENT_STATE_REVOKED) {
+ ret = -EINVAL;
+ goto out;
+ }
+
/*
* Get the event CPU numbers, and adjust them to local if the event is
* a per-package event that can be read locally
@@ -6350,6 +6355,9 @@ static DEFINE_MUTEX(perf_mediated_pmu_mutex);
/* !exclude_guest event of PMU with PERF_PMU_CAP_MEDIATED_VPMU */
static inline bool is_include_guest_event(struct perf_event *event)
{
+ if (!event->pmu)
+ return false;
+
if ((event->pmu->capabilities & PERF_PMU_CAP_MEDIATED_VPMU) &&
!event->attr.exclude_guest)
return true;
@@ -12977,6 +12985,7 @@ static void __pmu_detach_event(struct pmu *pmu, struct
perf_event *event,
exclusive_event_destroy(event);
module_put(pmu->module);
+ mediated_pmu_unaccount_event(event);
event->pmu = NULL; /* force fault instead of UAF */
}
--
2.38.1
