It is possible for the code in perf_event_read() to observe
event->state == PERF_EVENT_STATE_ACTIVE && event->oncpu == -1.
In this case, the percpu access in that branch will use an
invalid cpu number and cause invalid memory access. Wrap the
read of event->state and event->oncpu with READ_ONCE, then
validate the cpu number is valid. This check is done before
calling cpu_isolated() to not trigger a warning in cpumask_check().
Bug: 63928861
Change-Id: I216f6fc8c9637c0c78c9c45ec4cf6b75bfc3d01e
Signed-off-by: Siqi Lin <siqilin@google.com>