From: Peter Zijlstra <peterz@infradead.org>
To: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Cc: Zw Tang <shicenci@gmail.com>,
"linux-perf-users@vger.kernel.org"
<linux-perf-users@vger.kernel.org>,
mingo@redhat.com, boqun.feng@gmail.com,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
namhyung@kernel.org, will@kernel.org, juri.lelli@redhat.com
Subject: Re: [BUG] PREEMPT_RT: sleeping function called from invalid context in perf_event_wakeup()
Date: Fri, 13 Feb 2026 15:12:12 +0100 [thread overview]
Message-ID: <20260213141212.GU2995752@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <20260213124705.hpxaabypmuj4pfwg@hu-mojha-hyd.qualcomm.com>
On Fri, Feb 13, 2026 at 06:17:05PM +0530, Mukesh Ojha wrote:
> On Thu, Feb 05, 2026 at 12:08:55PM +0100, Peter Zijlstra wrote:
> > On Thu, Feb 05, 2026 at 06:42:05PM +0800, Zw Tang wrote:
> > > Hi,
> > >
> > > I am reporting a PREEMPT_RT “sleeping function called from invalid
> > > context” bug triggered by a syzkaller reproducer on Linux 6.19.0-rc7.
> > >
> > > The kernel reports:
> > >
> > > BUG: sleeping function called from invalid context at
> > > kernel/locking/spinlock_rt.c:48
> > > in_atomic(): 1, irqs_disabled(): 1, preempt_count: 4
> > >
> > > The splat points to perf’s wakeup path taking an RT spinlock while
> > > running in an atomic/IRQs-disabled context:
> > >
> > > merge_sched_in()
> > > -> perf_event_wakeup()
> > > -> __wake_up_common_lock()
> G> > -> rt_spin_lock()
> > > -> __might_resched() (complains about sleeping in invalid context)
> > >
> > > This suggests a locking semantic mismatch on PREEMPT_RT:
> > > perf_event_wakeup() (via __wake_up_common_lock()) ends up taking a
> > > lock that maps to rt_spin_lock(), which may sleep on RT kernels, but
> > > the current context is explicitly atomic with IRQs disabled.
> >
> > Fixes: f4b07fd62d4d ("perf/core: Use POLLHUP for pinned events in error")
> >
> > diff --git a/kernel/events/core.c b/kernel/events/core.c
> > index dad0d3d2e85f..216cf6ae1c7d 100644
> > --- a/kernel/events/core.c
> > +++ b/kernel/events/core.c
> > @@ -4017,7 +4017,8 @@ static int merge_sched_in(struct perf_event *event, void *data)
> > if (*perf_event_fasync(event))
> > event->pending_kill = POLL_ERR;
> >
> > - perf_event_wakeup(event);
> > + event->pending_wakeup = 1;
> > + irq_work_queue(&event->pending_irq);
> > } else {
> > struct perf_cpu_pmu_context *cpc = this_cpc(event->pmu_ctx->pmu);
>
>
> Looks like this https://lore.kernel.org/lkml/20250603045105.1731451-1-namhyung@kernel.org/
> got unnoticed.
Indeed, -ETOODAMNMUCHEMAIL :/
Let me go grab that one.
prev parent reply other threads:[~2026-02-13 14:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-05 10:42 Zw Tang
2026-02-05 11:08 ` Peter Zijlstra
2026-02-13 12:47 ` Mukesh Ojha
2026-02-13 14:12 ` Peter Zijlstra [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260213141212.GU2995752@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=boqun.feng@gmail.com \
--cc=juri.lelli@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=mukesh.ojha@oss.qualcomm.com \
--cc=namhyung@kernel.org \
--cc=shicenci@gmail.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®