[PATCH] perf/core: Fix race between perf_event_exit_task and perf_pending_task

[PATCH] perf/core: Fix race between perf_event_exit_task and perf_pending_task

[Luo Gengkun]

A race condition exists between perf_event_exit_task() and perf_pending_task().

During begin_new_exec(), perf_event_exit_task() may be called, and the
PF_EXITING flag is not set on task. so perf_sigtrap() continues to execute
and triggers WARN_ON_ONCE(event->ctx->task != current).

To fix this problem, also check if the event->ctx->task is TASK_TOMBSTONE.

Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
Signed-off-by: Luo Gengkun <luogengkun2@huawei.com>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1f5699b339ec..3422900263fa 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7543,7 +7543,7 @@ static void perf_sigtrap(struct perf_event *event)
 	 * Both perf_pending_task() and perf_pending_irq() can race with the
 	 * task exiting.
 	 */
-	if (current->flags & PF_EXITING)
+	if (current->flags & PF_EXITING || event->ctx->task == TASK_TOMBSTONE)
 		return;
 
 	/*
-- 
2.34.1

Re: [PATCH] perf/core: Fix race between perf_event_exit_task and perf_pending_task

[Ian Rogers]

On Wed, Apr 15, 2026 at 8:08 PM Luo Gengkun <luogengkun2@huawei.com> wrote:
>
> A race condition exists between perf_event_exit_task() and perf_pending_task().
>
> During begin_new_exec(), perf_event_exit_task() may be called, and the
> PF_EXITING flag is not set on task. so perf_sigtrap() continues to execute
> and triggers WARN_ON_ONCE(event->ctx->task != current).
>
> To fix this problem, also check if the event->ctx->task is TASK_TOMBSTONE.
>
> Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
> Signed-off-by: Luo Gengkun <luogengkun2@huawei.com>

Dmitry, the description and patch look sensible. Could you take a look?

Thanks,
Ian

> ---
>  kernel/events/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 1f5699b339ec..3422900263fa 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -7543,7 +7543,7 @@ static void perf_sigtrap(struct perf_event *event)
>          * Both perf_pending_task() and perf_pending_irq() can race with the
>          * task exiting.
>          */
> -       if (current->flags & PF_EXITING)
> +       if (current->flags & PF_EXITING || event->ctx->task == TASK_TOMBSTONE)
>                 return;
>
>         /*
> --
> 2.34.1
>

Re: [PATCH] perf/core: Fix race between perf_event_exit_task and perf_pending_task

[Dmitry Vyukov]

On Tue, 15 Sept 2026 at 23:35, Ian Rogers <irogers@google.com> wrote:
>
> On Wed, Apr 15, 2026 at 8:08 PM Luo Gengkun <luogengkun2@huawei.com> wrote:
> >
> > A race condition exists between perf_event_exit_task() and perf_pending_task().
> >
> > During begin_new_exec(), perf_event_exit_task() may be called, and the
> > PF_EXITING flag is not set on task. so perf_sigtrap() continues to execute
> > and triggers WARN_ON_ONCE(event->ctx->task != current).
> >
> > To fix this problem, also check if the event->ctx->task is TASK_TOMBSTONE.
> >
> > Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
> > Signed-off-by: Luo Gengkun <luogengkun2@huawei.com>
>
> Dmitry, the description and patch look sensible. Could you take a look?

Marco, please take a look.

I paged out all context long time ago... The code is too tricky to say
if it's possible/not possible/fixed by the patch/not fixed by the
patch looking at the diff.
A test would be helpful. Will also prevent regression in the next release.



> Thanks,
> Ian
>
> > ---
> >  kernel/events/core.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/kernel/events/core.c b/kernel/events/core.c
> > index 1f5699b339ec..3422900263fa 100644
> > --- a/kernel/events/core.c
> > +++ b/kernel/events/core.c
> > @@ -7543,7 +7543,7 @@ static void perf_sigtrap(struct perf_event *event)
> >          * Both perf_pending_task() and perf_pending_irq() can race with the
> >          * task exiting.
> >          */
> > -       if (current->flags & PF_EXITING)
> > +       if (current->flags & PF_EXITING || event->ctx->task == TASK_TOMBSTONE)
> >                 return;
> >
> >         /*
> > --
> > 2.34.1
> >

Re: [PATCH] perf/core: Fix race between perf_event_exit_task and perf_pending_task

[Peter Zijlstra]

On Thu, Apr 16, 2026 at 03:34:43AM +0000, Luo Gengkun wrote:
> A race condition exists between perf_event_exit_task() and perf_pending_task().
> 
> During begin_new_exec(), perf_event_exit_task() may be called, and the
> PF_EXITING flag is not set on task. so perf_sigtrap() continues to execute
> and triggers WARN_ON_ONCE(event->ctx->task != current).
> 
> To fix this problem, also check if the event->ctx->task is TASK_TOMBSTONE.
> 
> Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
> Signed-off-by: Luo Gengkun <luogengkun2@huawei.com>
> ---
>  kernel/events/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 1f5699b339ec..3422900263fa 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -7543,7 +7543,7 @@ static void perf_sigtrap(struct perf_event *event)
>  	 * Both perf_pending_task() and perf_pending_irq() can race with the
>  	 * task exiting.
>  	 */
> -	if (current->flags & PF_EXITING)
> +	if (current->flags & PF_EXITING || event->ctx->task == TASK_TOMBSTONE)
>  		return;

Since do_exit() also calls perf_event_exit_task() (albeit a little later
than exit_signals()), and task_can_queue_signal() will return false when
PF_EXITING, and we ignore the return value of
send_sig_perf()/send_sig_info(). I don't think we need to check both.

That is, I think:

	if (event->ctx->task == TASK_TOMBSTONE)

is sufficient. Also, the comment needs updating.

[PATCH v2] perf/core: Fix race between perf_event_exit_task() and perf_pending_task()

[Luo Gengkun]

A race condition exists between perf_event_exit_task() and
perf_pending_task() during begin_new_exec().

During begin_new_exec(), perf_event_exit_task() may be called, and the
PF_EXITING flag is not set on task. So perf_sigtrap() continues to execute
and triggers WARN_ON_ONCE(event->ctx->task != current).

Since both task exit and exec paths can call perf_event_exit_task() which
sets ctx->task to TASK_TOMBSTONE, fix this by explicitly checking if
event->ctx->task equals TASK_TOMBSTONE and dropping the redundant
PF_EXITING check.

Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
Signed-off-by: Luo Gengkun <luogengkun2@huawei.com>
---
v1 -> v2:
- Drop the redundant PF_EXITING check and only check for TASK_TOMBSTONE.
- Update the code comment to reflect this unified exec/exit race protection.
---
 kernel/events/core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index fe33fe15689d..8f4b61a135e8 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7616,9 +7616,11 @@ static void perf_sigtrap(struct perf_event *event)
 {
 	/*
 	 * Both perf_pending_task() and perf_pending_irq() can race with the
-	 * task exiting.
+	 * task exiting or exec-ing. We can determine if such a race has
+	 * occurred by checking if perf_event_exit_task(), which will set
+	 * ctx->task to TASK_TOMBSTONE, has already been called.
 	 */
-	if (current->flags & PF_EXITING)
+	if (event->ctx->task == TASK_TOMBSTONE)
 		return;
 
 	/*
-- 
2.34.1