[PATCH v6 1/3] perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

[Peter Zijlstra]

On Thu, Aug 06, 2026 at 06:52:21AM -0700, Puranjay Mohan wrote:
> perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and
> cpc->task_epc is only non-NULL while a task context is scheduled in on
> this CPU. __perf_pmu_sched_task() therefore always passes NULL:
> 
>   Unable to handle kernel NULL pointer dereference at virtual address 00
>   pc : armv8pmu_sched_task+0x14/0x50
>   Call trace:
>    armv8pmu_sched_task+0x14/0x50 (P)
>    perf_pmu_sched_task+0xac/0x108
>    __perf_event_task_sched_out+0x6c/0xe0
> 
> Pass &cpc->epc instead. __perf_init_event_pmu_context() sets its ->pmu
> when the PMU is registered; ->ctx stays NULL until a CPU-wide event
> attaches. That is enough here because armv8pmu_sched_task() is the only
> in-tree implementation that dereferences the argument at all, and it
> only reads ->pmu. The oops therefore needs BRBE, which arrived in v6.17.
> 
> Fixes: bd2756811766 ("perf: Rewrite core context handling")
> Cc: stable at vger.kernel.org
> Acked-by: Usama Arif <usama.arif at linux.dev>
> Signed-off-by: Puranjay Mohan <puranjay at kernel.org>
> ---
>  kernel/events/core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index b282de3e7d7ca..9815894b67e77 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -3907,7 +3907,8 @@ static void __perf_pmu_sched_task(struct perf_cpu_pmu_context *cpc,
>  	perf_ctx_lock(cpuctx, cpuctx->task_ctx);
>  	perf_pmu_disable(pmu);
>  
> -	pmu->sched_task(cpc->task_epc, task, sched_in);
> +	pmu->sched_task(cpc->task_epc ? cpc->task_epc : &cpc->epc,
> +			task, sched_in);

This can be written like: cpc->task_epc ?: &cpc->epc.

However, if cpc-task_epc is always NULL, then this all seems like an
overly complicated way of writing: &cpc->epc. What gives?