[PATCH] perf/x86: Prevent NULL event deref in handle_pmi_common()

[evan . li]

From: Evan Li <evan.li@xxxxxxxxxxxxxxxxx>

handle_pmi_common() may observe an active bit set in cpuc->active_mask
while the corresponding cpuc->events[] entry has already been cleared,
which leads to a NULL pointer dereference.

This can happen when interrupt throttling stops all events in a group
while PEBS processing is still in progress. perf_event_overflow() can
trigger perf_event_throttle_group(), which stops the group and clears
the cpuc->events[] entry, but the active bit may still be set when
handle_pmi_common() iterates over the events.

The following change:

7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")

moved cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and
relied on cpuc->active_mask/pebs_enabled checks. However,
handle_pmi_common() can still encounter a NULL cpuc->events[] entry
despite the active bit being set.

Add an explicit NULL check on the event pointer before using it to
avoid dereferencing a cleared cpuc->events[] slot.

Fixes: 7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")
Reported-by: kitta <kitta@xxxxxxxxxxxxxxxxx>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220855
Co-developed-by: kitta <kitta@xxxxxxxxxxxxxxxxx>
Signed-off-by: Evan Li <evan.li@xxxxxxxxxxxxxxxxx>
---
 arch/x86/events/intel/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 853fe073b..a7454ed6a 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -3378,6 +3378,9 @@ static int handle_pmi_common(struct pt_regs *regs, u64 status)
 
 		if (!test_bit(bit, cpuc->active_mask))
 			continue;
+		/* Check if event is NULL to prevent null pointer dereference */
+		if (!event)
+			continue;
 
 		/*
 		 * There may be unprocessed PEBS records in the PEBS buffer,
-- 
2.43.7