[PATCH 1/2] perf/core: Avoid NULL dereference in mux interval store

[Dapeng Mi]

perf_pmu_register() currently exposes the PMU device and its attributes
before the per-CPU perf_cpu_pmu_context (cpc) has been allocated and
initialized. That allows a race where user space writes
perf_event_mux_interval_ms before cpc is ready, and
perf_event_mux_interval_ms_store() dereferences it unconditionally.

Fix this by allocating and initializing the per-CPU PMU context before
making the PMU attribute visible, and add a NULL check in
perf_event_mux_interval_ms_store() to avoid dereferencing a missing cpc.

Reported-by: Hanxiang Xu <xuhx@xxxxxxxxxxx>
Closes: https://lore.kernel.org/all/de936c3.1476b.1a162c34cec.Coremail.xuhx@xxxxxxxxxxx/
Fixes: 62b856397927 ("perf: Add sysfs entry to adjust multiplexing interval per PMU")
Signed-off-by: Dapeng Mi <dapeng1.mi@xxxxxxxxxxxxxxx>
---
 kernel/events/core.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7cdd02dba4f1..e088c31534bc 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -12831,6 +12831,9 @@ perf_event_mux_interval_ms_store(struct device *dev,
 	if (timer == pmu->hrtimer_interval_ms)
 		return count;
 
+	if (!pmu->cpu_pmu_context)
+		return -ENODEV;
+
 	mutex_lock(&mux_interval_mutex);
 	pmu->hrtimer_interval_ms = timer;
 
@@ -13062,12 +13065,6 @@ int perf_pmu_register(struct pmu *_pmu, const char *name, int type)
 	pmu->type = pmu_type.id;
 	atomic_set(&pmu->exclusive_cnt, 0);
 
-	if (pmu_bus_running && !pmu->dev) {
-		int ret = pmu_dev_alloc(pmu);
-		if (ret)
-			return ret;
-	}
-
 	pmu->cpu_pmu_context = alloc_percpu(struct perf_cpu_pmu_context *);
 	if (!pmu->cpu_pmu_context)
 		return -ENOMEM;
@@ -13086,6 +13083,12 @@ int perf_pmu_register(struct pmu *_pmu, const char *name, int type)
 		__perf_mux_hrtimer_init(cpc, cpu);
 	}
 
+	if (pmu_bus_running && !pmu->dev) {
+		int ret = pmu_dev_alloc(pmu);
+		if (ret)
+			return ret;
+	}
+
 	if (!pmu->start_txn) {
 		if (pmu->pmu_enable) {
 			/*
-- 
2.34.1