From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C478D42E8F6 for ; Tue, 11 Aug 2026 23:53:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786492432; cv=none; b=a4q4yeNucX+D+LxYAHvoRSnjrm4Z1QDrTF9BX7tp7scse1RBX9iGqBwmXWOcugeIxCmEdBoWJOXnsukBI/D1InZwBA74DmvryY6O6ikV6iPi07GrktsBLisdFShz9rQrllaisPYoJYMqw2WXLQPi8B/mFhDpNAtFY89gn12NTd0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786492432; c=relaxed/simple; bh=qpY9hwUm1VtCpfQaT9JtmZnLLzTR3oMcZSOjkRsdLB4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GWUItMT+i7Qqar7Tekojbjv9tC0+Lfz8P4n2eqNK9juo5gmxWCPiPwB+APNcmDxufaKAdNTKXAtgaa9oHmInjNEkaKphBiwlde4Os7YBvTJcm2V9FZPwRvn/L7jb0J3utGlmATIGyRzLv1hDyXMBRSEnGMYyk6vSt2sOl8wYs3k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Wp889cmc; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Wp889cmc" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-cbee3777e1cso238182a12.3 for ; Tue, 11 Aug 2026 16:53:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786492430; x=1787097230; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=AY/Dp7ip8sCatNzHcOgs/oMLEEtZQxV5ZR6XyZHm6HY=; b=Wp889cmcqoYlX8mUZlm58ciIBxFZxpDkuD+/G4g1QUyg6UEajlf23DztPx/y6OZ59K rKDt7WdR9yxsIs5YE9lwEgsJuINzhiMXo+dD9SmGx40U5lQv8h22PyDGkKtMWlVCfvA5 SBLCOxlrOc5HBQ1b4dq1Cjf4nMFktyD/k852vyCF2hfGAi0UoVOXHfl1FDL9rPnAjtZR miRQEkxOOiIlFaOfbdycMoeDsy0iAvnz57dGto332Qg0gYSKmdXDvpEPylv94hzozuLk ZiZumgwCMOy20kWIlzFc7x7/DFjjyMMK0sKuUfnEfOu9LPOIGwlTeWn1X95LrNS16+it rNww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786492430; x=1787097230; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AY/Dp7ip8sCatNzHcOgs/oMLEEtZQxV5ZR6XyZHm6HY=; b=kHBeK8WNDfrpSunUbrub34xvJaWahy7Puj9tiPeD9EC+NoCl7OK/DXqgtFHs5RHrrz VtVMBw1lq5FJtlRvS08mYIb8djWqYAZ18E4R81LnIlTb8VZU+4DNwiZDJ8gWkrK12nBx wkpa+lYC3QJjgTFrvMNSXNgxavdmcvWAGtAmb9VxksRaLzH0LusCGKwocAXBE7TYvClI vbIIu0TFXIbnEe/kijdAGIA12/+PLOmH0q4Ag3SDLlYrjRqLm+j0CqNE6cUZ8uO5t67F XCwTOuJuK91Lsa74MSPsuifMdUVPkregzCl63BdsoM7WKWtqxInpjxer89TBzMDYSTNi 7CHA== X-Forwarded-Encrypted: i=1; AHgh+RqkWVLEJwrs6l/259to8aRtqJ1CH+U+SGoru8IKUR+74uY42qq+tWLRLkY6PFmJlB2brBvYNflkzXUTRbA=@vger.kernel.org X-Gm-Message-State: AOJu0YyD4tM3iB4r9B6Lc1Dh3BkTptpUQp7cWyIWRjOyQvHEbnUoVFfk oFDokzZD0fvaVdvW1jDDBCVyv+h5bC8e9MMSyj7wXbwPnfQr8GuEIHop X-Gm-Gg: AR+sD12pQF9T+Bf9ET8DF9zbR9N/wV4xnKUTkRLt0OVAp2yV31baQWDDwo+SAAEcpc1 Z82fPhKcSUUjZ5a4CWgMMIvGN/XW5Y5YzggrDMVBapVlxoU+w38s3XpMYF6ck/VJ2BPhxqtsjED Ma7t25qoHAOUHf22DHmHI7PLhVVr90wM3uTymP0uvhGafgmTT+ZXYOJUR/NJChRcAWm88acNxSG i96337v737sJpV7OLsI6YZhL7jUsDLoBY4B0aNq9UwoiegQGFfjhVP/rcjgn0BM5m6Kp0J/DDW4 MoPcloXjmnDGyhksgYLDm+qDH1MSejlkoOkQludMZYXGWyqJDDafm81sH1XqnKDFusxqQZL8xgp Iyw2YMp1kdDas4lIoyWhLQUJst1BVL8TFNT8c1BciqVsdUDv/sNwudWaoiE5I3JGT+V6j8aiX6S H++o0JaOu+VQWF953K0OmC+bXYRDfWInhflYx/xE6jHy0grsQfAYGp40ToL5aIsT5V+hyVhFZ+b iRqqp6J/fOzgBuKfZHFDzYoHRD8WjBR6k9idHK1yo8H1o2/OPaKXQ== X-Received: by 2002:a05:6a20:3c8f:b0:3c3:8d4c:6673 with SMTP id adf61e73a8af0-3cc3f8ade77mr603568637.37.1786492429914; Tue, 11 Aug 2026 16:53:49 -0700 (PDT) Received: from deepanshu-Legion-Pro-5-16AFR10.. ([2405:201:682f:383f:4531:180e:142a:c2f1]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31cf3d0b432sm3853828eec.8.2026.08.11.16.53.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 16:53:48 -0700 (PDT) From: Deepanshu Kartikey To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org, mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, song@kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, martin.lau@linux.dev, yonghong.song@linux.dev, emil@etsalapatis.com, kpsingh@kernel.org, mattbobrowski@google.com, rostedt@goodmis.org, mhiramat@kernel.org, mathieu.desnoyers@efficios.com, me@kylehuey.com Cc: linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+651d2774bd1d8395595f@syzkaller.appspotmail.com Subject: [PATCH] perf/bpf: Fix data race in __perf_event_overflow Date: Wed, 12 Aug 2026 05:23:31 +0530 Message-ID: <20260811235331.10044-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit perf_event_detach_bpf_prog() writes event->prog = NULL under bpf_event_mutex, while __perf_event_overflow() reads event->prog concurrently without any lock protection. This causes a data race detected by KCSAN. __perf_event_overflow() can be called from interrupt/NMI context, so it cannot acquire bpf_event_mutex. Fix the race by using WRITE_ONCE() in perf_event_detach_bpf_prog() and READ_ONCE() in __perf_event_overflow(). Also store the result of READ_ONCE() in a local variable to avoid reading event->prog twice which could result in a NULL pointer dereference if the pointer becomes NULL between the two reads. Reported-by: syzbot+651d2774bd1d8395595f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=651d2774bd1d8395595f Fixes: f11f10bfa1ca ("perf/bpf: Call BPF handler directly, not through overflow machinery") Signed-off-by: Deepanshu Kartikey --- kernel/events/core.c | 4 +++- kernel/trace/bpf_trace.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index ba5bd6a78fe7..9d9c5477772e 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -10753,6 +10753,7 @@ static int __perf_event_overflow(struct perf_event *event, { int events = atomic_read(&event->event_limit); int ret = 0; + struct bpf_prog *prog; /* * Non-sampling counters might still use the PMI to fold short @@ -10766,7 +10767,8 @@ static int __perf_event_overflow(struct perf_event *event, if (event->attr.aux_pause) perf_event_aux_pause(event->aux_event, true); - if (event->prog && event->prog->type == BPF_PROG_TYPE_PERF_EVENT && + prog = READ_ONCE(event->prog); + if (prog && prog->type == BPF_PROG_TYPE_PERF_EVENT && !bpf_overflow_handler(event, data, regs)) goto out; diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 75495a5c3507..ee61dc760045 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -2018,7 +2018,7 @@ void perf_event_detach_bpf_prog(struct perf_event *event) put: prog = event->prog; - event->prog = NULL; + WRITE_ONCE(event->prog, NULL); unlock: mutex_unlock(&bpf_event_mutex); -- 2.43.0