Re: [PATCH] perf/x86: Prevent NULL event deref in handle_pmi_common()

[Mi, Dapeng]

On 12/12/2025 6:44 PM, Peter Zijlstra wrote:
> On Fri, Dec 12, 2025 at 04:49:43PM +0800, evan.li@xxxxxxxxxxxxxxxxx wrote:
>> From: Evan Li <evan.li@xxxxxxxxxxxxxxxxx>
>>
>> handle_pmi_common() may observe an active bit set in cpuc->active_mask
>> while the corresponding cpuc->events[] entry has already been cleared,
>> which leads to a NULL pointer dereference.
>>
>> This can happen when interrupt throttling stops all events in a group
>> while PEBS processing is still in progress. perf_event_overflow() can
>> trigger perf_event_throttle_group(), which stops the group and clears
>> the cpuc->events[] entry, but the active bit may still be set when
>> handle_pmi_common() iterates over the events.
>>
>> The following change:
>>
>> 7e772a93 ("perf/x86: Fix NULL event access and potential PEBS record loss")
>>
>> moved cpuc->events[] clearing from x86_pmu_stop() to x86_pmu_del() and
>> relied on cpuc->active_mask/pebs_enabled checks. However,
>> handle_pmi_common() can still encounter a NULL cpuc->events[] entry
>> despite the active bit being set.
> How? What is doing del() concurrently with the pmi?

As long as stop() is called before del(), the corresponding bit in
active_mask should be cleared. Perhaps it's because x86_pmu_start() is
called first and x86_pmu_enable() is still not called and PMI arrives? 
Anyway I can't figure out why this issue could happen. @kitta @evan could
you please share how to reproduce this issue? I would try to reproduce this
issue locally. Thanks.


>