[PATCH v6 1/3] perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

[Puranjay Mohan]

On Fri, Aug 7, 2026 at 10:40 AM Peter Zijlstra <peterz at infradead.org> wrote:
>
> On Thu, Aug 06, 2026 at 06:52:21AM -0700, Puranjay Mohan wrote:
> > perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and
> > cpc->task_epc is only non-NULL while a task context is scheduled in on
> > this CPU. __perf_pmu_sched_task() therefore always passes NULL:
> >
> >   Unable to handle kernel NULL pointer dereference at virtual address 00
> >   pc : armv8pmu_sched_task+0x14/0x50
> >   Call trace:
> >    armv8pmu_sched_task+0x14/0x50 (P)
> >    perf_pmu_sched_task+0xac/0x108
> >    __perf_event_task_sched_out+0x6c/0xe0
> >
> > Pass &cpc->epc instead. __perf_init_event_pmu_context() sets its ->pmu
> > when the PMU is registered; ->ctx stays NULL until a CPU-wide event
> > attaches. That is enough here because armv8pmu_sched_task() is the only
> > in-tree implementation that dereferences the argument at all, and it
> > only reads ->pmu. The oops therefore needs BRBE, which arrived in v6.17.
> >
> > Fixes: bd2756811766 ("perf: Rewrite core context handling")
> > Cc: stable at vger.kernel.org
> > Acked-by: Usama Arif <usama.arif at linux.dev>
> > Signed-off-by: Puranjay Mohan <puranjay at kernel.org>
> > ---
> >  kernel/events/core.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/events/core.c b/kernel/events/core.c
> > index b282de3e7d7ca..9815894b67e77 100644
> > --- a/kernel/events/core.c
> > +++ b/kernel/events/core.c
> > @@ -3907,7 +3907,8 @@ static void __perf_pmu_sched_task(struct perf_cpu_pmu_context *cpc,
> >       perf_ctx_lock(cpuctx, cpuctx->task_ctx);
> >       perf_pmu_disable(pmu);
> >
> > -     pmu->sched_task(cpc->task_epc, task, sched_in);
> > +     pmu->sched_task(cpc->task_epc ? cpc->task_epc : &cpc->epc,
> > +                     task, sched_in);
>
> This can be written like: cpc->task_epc ?: &cpc->epc.
>
> However, if cpc-task_epc is always NULL, then this all seems like an
> overly complicated way of writing: &cpc->epc. What gives?

Nothing, you're right, it should just be &cpc->epc.

I wrote the ternary expecting patch 2 to make cpc->task_epc reachable
here, but it does not.

Will fix it in v7.

Thanks,
Puranjay