Re: [PATCH v9 12/16] KVM: arm64: PMU: Pass the pPMU to kvm_map_pmu_event()

On Mon, 20 Jul 2026 at 07:03, <[email protected]> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [Critical] Host kernel panic via NULL pointer dereference in PMU event creation when a guest without a PMU toggles `MDCR_EL2.HPME`.

I don't think it's reachable. With no PMU, arm_pmu is NULL but the
event is never created: the cycle counter can't be enabled (PMCR.E is
0 and the guest can't write the hidden PMCR), and the
nested-transition path is gated by kvm_vcpu_has_pmu().

/fuad

> --
>
> --- Patch [12]: [PATCH v9 12/16] KVM: arm64: PMU: Pass the pPMU to kvm_map_pmu_event() ---
> commit 61c39cb093b2170b92839ae7097044db9d1474cc
> Author: Akihiko Odaki <[email protected]>
>
> KVM: arm64: PMU: Pass the pPMU to kvm_map_pmu_event()
>
> This patch updates kvm_map_pmu_event() to accept the PMU structure directly
> rather than implicitly looking it up via the VM argument. This prepares the
> code to map events against a per-vCPU selected pPMU in the future.
>
> > diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c
> > index c5c505b6fc61c..27db8877f96ea 100644
> > --- a/arch/arm64/kvm/pmu-emul.c
> > +++ b/arch/arm64/kvm/pmu-emul.c
> [ ... ]
> > @@ -725,7 +723,7 @@ static void kvm_pmu_create_perf_event(struct kvm_pmc *pmc)
> >        * Don't create an event if we're running on hardware that requires
> >        * PMUv3 event translation and we couldn't find a valid mapping.
> >        */
> > -     eventsel = kvm_map_pmu_event(vcpu->kvm, eventsel);
> > +     eventsel = kvm_map_pmu_event(vcpu->kvm->arch.arm_pmu, eventsel);
>
> [Severity: Critical]
> This is a pre-existing issue, but this change makes it a bit more explicit.
> Could this pass a NULL pointer to kvm_map_pmu_event() and cause a host kernel
> panic?
>
> If a guest with nested virtualization enabled but no PMU configured toggles
> the MDCR_EL2.HPME bit, access_mdcr() will unconditionally trigger a
> KVM_REQ_RELOAD_PMU request without checking if the VM actually has a PMU.
>
> When kvm_vcpu_reload_pmu() handles this request on the next vCPU entry,
> it tries to reprogram the cycle counter (which defaults to enabled). This
> eventually reaches kvm_pmu_create_perf_event():
>
> arch/arm64/kvm/sys_regs.c:access_mdcr() {
>     ...
>     kvm_pmu_handle_mdcr(vcpu, old, val); /* Triggers KVM_REQ_RELOAD_PMU */
> }
>
> arch/arm64/kvm/pmu-emul.c:kvm_pmu_create_perf_event() {
>     ...
>     eventsel = kvm_map_pmu_event(vcpu->kvm->arch.arm_pmu, eventsel);
> }
>
> arch/arm64/kvm/pmu-emul.c:kvm_map_pmu_event() {
>     ...
>     if (unlikely(pmu->map_pmuv3_event)) /* NULL pointer dereference */
> }
>
> Because no PMU was initialized for this guest, vcpu->kvm->arch.arm_pmu is NULL.
>
> Could access_mdcr() or kvm_pmu_create_perf_event() check if the PMU is
> actually initialized before attempting to create events?
>
> >       if (eventsel < 0)
> >               return;
> >
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=12
>