* [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data()
@ 2026-09-20 23:16 Namhyung Kim
2026-09-22 13:38 ` Peter Zijlstra
2026-09-23 9:52 ` [tip: perf/urgent] " tip-bot2 for Namhyung Kim
0 siblings, 2 replies; 6+ messages in thread
From: Namhyung Kim @ 2026-09-20 23:16 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar
Cc: Mark Rutland, Alexander Shishkin, Arnaldo Carvalho de Melo, LKML
The attach_perf_ctx_data() can race on global and !global cases. The
global case is protected by global_ctx_data_rwsem and shares a single
reference count using perf_ctx_data.global field.
But when it races with !global case, it may miss to set the global field
and result in a reference count leak.
CPU1 CPU2
----------------------------------------------------------------
attach_task_ctx_data(global=1) attach_task_ctx_data(global=0)
cd1 = alloc_perf_ctx_data() cd2 = alloc_perf_ctx_data()
try_cmpxchg() // ok
// task->perf_ctx_data = cd2
try_cmpxchg() // fail; old = cd2; global = 0
refcount_inc_not_zero() // cd2->refcount++;
free_perf_ctx_data() // cd1
Then later detach_global_ctx_data() will see the data but it's not
marked as global, so it won't call detach_task_ctx_data().
Fixes: 506e64e710ff ("perf: attach/detach PMU specific data")
Assisted-by: Sashiko.dev:Gemini-3.1-pro
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
kernel/events/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index db7b76d6b68aa55d..e180134bad5e0ae3 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5454,6 +5454,8 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
}
if (refcount_inc_not_zero(&old->refcount)) {
+ if (global)
+ old->global = true;
free_perf_ctx_data(cd); /* unused */
return 0;
}
--
2.55.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data()
2026-09-20 23:16 [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data() Namhyung Kim
@ 2026-09-22 13:38 ` Peter Zijlstra
2026-09-23 4:47 ` Namhyung Kim
2026-09-23 9:52 ` [tip: perf/urgent] " tip-bot2 for Namhyung Kim
1 sibling, 1 reply; 6+ messages in thread
From: Peter Zijlstra @ 2026-09-22 13:38 UTC (permalink / raw)
To: Namhyung Kim
Cc: Ingo Molnar, Mark Rutland, Alexander Shishkin,
Arnaldo Carvalho de Melo, LKML
On Sun, Sep 20, 2026 at 04:16:39PM -0700, Namhyung Kim wrote:
> The attach_perf_ctx_data() can race on global and !global cases. The
> global case is protected by global_ctx_data_rwsem and shares a single
> reference count using perf_ctx_data.global field.
>
> But when it races with !global case, it may miss to set the global field
> and result in a reference count leak.
>
> CPU1 CPU2
> ----------------------------------------------------------------
> attach_task_ctx_data(global=1) attach_task_ctx_data(global=0)
> cd1 = alloc_perf_ctx_data() cd2 = alloc_perf_ctx_data()
> try_cmpxchg() // ok
> // task->perf_ctx_data = cd2
>
> try_cmpxchg() // fail; old = cd2; global = 0
> refcount_inc_not_zero() // cd2->refcount++;
> free_perf_ctx_data() // cd1
Urgh, took a good while to remember how all that worked. Also, I think
it might have been clearer written like so:
CPU1 CPU2
attach_task_ctx_data(.global=1) attach_task_ctx_data(.global=0)
cd1 = alloc_perf_ctx_data(); cd2 = alloc_perf_ctx_data();
// { .global = 0, .refcount = 1 };
try_cmpxchg(); // success,
// task->perf_ctx_data = cd2
try_cmpxhg(); // fail; old = cd2
refcount_inc_not_zero(&old->refcount); // success
// old.refcount = 2
free_perf_ctx_data(cd1);
> Then later detach_global_ctx_data() will see the data but it's not
> marked as global, so it won't call detach_task_ctx_data().
>
> Fixes: 506e64e710ff ("perf: attach/detach PMU specific data")
> Assisted-by: Sashiko.dev:Gemini-3.1-pro
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> ---
> kernel/events/core.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index db7b76d6b68aa55d..e180134bad5e0ae3 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -5454,6 +5454,8 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
> }
>
> if (refcount_inc_not_zero(&old->refcount)) {
> + if (global)
> + old->global = true;
> free_perf_ctx_data(cd); /* unused */
> return 0;
> }
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data()
2026-09-22 13:38 ` Peter Zijlstra
@ 2026-09-23 4:47 ` Namhyung Kim
2026-09-23 7:51 ` Peter Zijlstra
0 siblings, 1 reply; 6+ messages in thread
From: Namhyung Kim @ 2026-09-23 4:47 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Ingo Molnar, Mark Rutland, Alexander Shishkin,
Arnaldo Carvalho de Melo, LKML
On Tue, Sep 22, 2026 at 03:38:35PM +0200, Peter Zijlstra wrote:
> On Sun, Sep 20, 2026 at 04:16:39PM -0700, Namhyung Kim wrote:
> > The attach_perf_ctx_data() can race on global and !global cases. The
> > global case is protected by global_ctx_data_rwsem and shares a single
> > reference count using perf_ctx_data.global field.
> >
> > But when it races with !global case, it may miss to set the global field
> > and result in a reference count leak.
> >
> > CPU1 CPU2
> > ----------------------------------------------------------------
> > attach_task_ctx_data(global=1) attach_task_ctx_data(global=0)
> > cd1 = alloc_perf_ctx_data() cd2 = alloc_perf_ctx_data()
> > try_cmpxchg() // ok
> > // task->perf_ctx_data = cd2
> >
> > try_cmpxchg() // fail; old = cd2; global = 0
> > refcount_inc_not_zero() // cd2->refcount++;
> > free_perf_ctx_data() // cd1
>
> Urgh, took a good while to remember how all that worked. Also, I think
> it might have been clearer written like so:
>
> CPU1 CPU2
>
> attach_task_ctx_data(.global=1) attach_task_ctx_data(.global=0)
> cd1 = alloc_perf_ctx_data(); cd2 = alloc_perf_ctx_data();
> // { .global = 0, .refcount = 1 };
>
> try_cmpxchg(); // success,
> // task->perf_ctx_data = cd2
> try_cmpxhg(); // fail; old = cd2
> refcount_inc_not_zero(&old->refcount); // success
> // old.refcount = 2
> free_perf_ctx_data(cd1);
I see. I'll do better next time. Let me know if you want me to resend.
Thanks,
Namhyung
>
> > Then later detach_global_ctx_data() will see the data but it's not
> > marked as global, so it won't call detach_task_ctx_data().
> >
> > Fixes: 506e64e710ff ("perf: attach/detach PMU specific data")
> > Assisted-by: Sashiko.dev:Gemini-3.1-pro
> > Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> > ---
> > kernel/events/core.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/kernel/events/core.c b/kernel/events/core.c
> > index db7b76d6b68aa55d..e180134bad5e0ae3 100644
> > --- a/kernel/events/core.c
> > +++ b/kernel/events/core.c
> > @@ -5454,6 +5454,8 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
> > }
> >
> > if (refcount_inc_not_zero(&old->refcount)) {
> > + if (global)
> > + old->global = true;
> > free_perf_ctx_data(cd); /* unused */
> > return 0;
> > }
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data()
2026-09-23 4:47 ` Namhyung Kim
@ 2026-09-23 7:51 ` Peter Zijlstra
0 siblings, 0 replies; 6+ messages in thread
From: Peter Zijlstra @ 2026-09-23 7:51 UTC (permalink / raw)
To: Namhyung Kim
Cc: Ingo Molnar, Mark Rutland, Alexander Shishkin,
Arnaldo Carvalho de Melo, LKML
On Tue, Sep 22, 2026 at 09:47:21PM -0700, Namhyung Kim wrote:
> On Tue, Sep 22, 2026 at 03:38:35PM +0200, Peter Zijlstra wrote:
> > On Sun, Sep 20, 2026 at 04:16:39PM -0700, Namhyung Kim wrote:
> > > The attach_perf_ctx_data() can race on global and !global cases. The
> > > global case is protected by global_ctx_data_rwsem and shares a single
> > > reference count using perf_ctx_data.global field.
> > >
> > > But when it races with !global case, it may miss to set the global field
> > > and result in a reference count leak.
> > >
> > > CPU1 CPU2
> > > ----------------------------------------------------------------
> > > attach_task_ctx_data(global=1) attach_task_ctx_data(global=0)
> > > cd1 = alloc_perf_ctx_data() cd2 = alloc_perf_ctx_data()
> > > try_cmpxchg() // ok
> > > // task->perf_ctx_data = cd2
> > >
> > > try_cmpxchg() // fail; old = cd2; global = 0
> > > refcount_inc_not_zero() // cd2->refcount++;
> > > free_perf_ctx_data() // cd1
> >
> > Urgh, took a good while to remember how all that worked. Also, I think
> > it might have been clearer written like so:
> >
> > CPU1 CPU2
> >
> > attach_task_ctx_data(.global=1) attach_task_ctx_data(.global=0)
> > cd1 = alloc_perf_ctx_data(); cd2 = alloc_perf_ctx_data();
> > // { .global = 0, .refcount = 1 };
> >
> > try_cmpxchg(); // success,
> > // task->perf_ctx_data = cd2
> > try_cmpxhg(); // fail; old = cd2
> > refcount_inc_not_zero(&old->refcount); // success
> > // old.refcount = 2
> > free_perf_ctx_data(cd1);
>
> I see. I'll do better next time. Let me know if you want me to resend.
Nah, I'll make a few edits and stuff it in a git tree somewhere.
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip: perf/urgent] perf/core: Fix a refcount leak in attach_perf_ctx_data()
2026-09-20 23:16 [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data() Namhyung Kim
2026-09-22 13:38 ` Peter Zijlstra
@ 2026-09-23 9:52 ` tip-bot2 for Namhyung Kim
1 sibling, 0 replies; 6+ messages in thread
From: tip-bot2 for Namhyung Kim @ 2026-09-23 9:52 UTC (permalink / raw)
To: linux-tip-commits; +Cc: Namhyung Kim, Peter Zijlstra (Intel), x86, linux-kernel
The following commit has been merged into the perf/urgent branch of tip:
Commit-ID: cca4980630b3c7a85f53cb43c6018184ce5d4e37
Gitweb: https://git.kernel.org/tip/cca4980630b3c7a85f53cb43c6018184ce5d4e37
Author: Namhyung Kim <namhyung@kernel.org>
AuthorDate: Sun, 20 Sep 2026 16:16:39 -07:00
Committer: Peter Zijlstra <peterz@infradead.org>
CommitterDate: Wed, 23 Sep 2026 11:48:35 +02:00
perf/core: Fix a refcount leak in attach_perf_ctx_data()
The attach_perf_ctx_data() can race on global and !global cases. The
global case is protected by global_ctx_data_rwsem and shares a single
reference count using perf_ctx_data.global field.
But when it races with !global case, it may miss to set the global field
and result in a reference count leak.
CPU1 CPU2
----------------------------------------------------------------
attach_task_ctx_data(.global=1) attach_task_ctx_data(.global=0)
cd1 = alloc_perf_ctx_data(); cd2 = alloc_perf_ctx_data();
// { .global = 0, .refcount = 1 };
try_cmpxchg(); // success,
// task->perf_ctx_data = cd2
try_cmpxhg(); // fail; old = cd2
refcount_inc_not_zero(&old->refcount); // success
// old.refcount = 2
free_perf_ctx_data(cd1);
Then later detach_global_ctx_data() will see the data but it's not
marked as global, so it won't call detach_task_ctx_data().
Fixes: 506e64e710ff ("perf: attach/detach PMU specific data")
Assisted-by: Sashiko.dev:Gemini-3.1-pro
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260920231639.11910-1-namhyung@kernel.org
---
kernel/events/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index db7b76d..e180134 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5454,6 +5454,8 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
}
if (refcount_inc_not_zero(&old->refcount)) {
+ if (global)
+ old->global = true;
free_perf_ctx_data(cd); /* unused */
return 0;
}
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data()
@ 2026-06-15 5:11 Namhyung Kim
0 siblings, 0 replies; 6+ messages in thread
From: Namhyung Kim @ 2026-06-15 5:11 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar
Cc: Mark Rutland, Alexander Shishkin, Arnaldo Carvalho de Melo, LKML
The attach_perf_ctx_data() can race on global and !global cases. The
global case is protected by global_ctx_data_rwsem and shares a single
reference count using perf_ctx_data.global field.
But when it races with !global case, it may miss to set the global field
and result in a reference count leak.
CPU1 CPU2
----------------------------------------------------------------
attach_task_ctx_data(global=1) attach_task_ctx_data(global=0)
cd1 = alloc_perf_ctx_data() cd2 = alloc_perf_ctx_data()
try_cmpxchg() // ok
// task->perf_ctx_data = cd2
try_cmpxchg() // fail; old = cd2; global = 0
refcount_inc_not_zero() // cd2->refcount++;
free_perf_ctx_data() // cd1
Then later detach_global_ctx_data() will see the data but it's not
marked as global, so it won't call detach_task_ctx_data().
Fixes: 506e64e710ff ("perf: attach/detach PMU specific data")
Assisted-by: Sashiko.dev:Gemini-3.1-pro
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
kernel/events/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7935d5663944ee1c..dc598e3822d062d2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5445,6 +5445,8 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
}
if (refcount_inc_not_zero(&old->refcount)) {
+ if (global)
+ old->global = true;
free_perf_ctx_data(cd); /* unused */
return 0;
}
--
2.54.0
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-23 9:52 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-20 23:16 [PATCH RESEND] perf/core: Fix a refcount leak in attach_perf_ctx_data() Namhyung Kim
2026-09-22 13:38 ` Peter Zijlstra
2026-09-23 4:47 ` Namhyung Kim
2026-09-23 7:51 ` Peter Zijlstra
2026-09-23 9:52 ` [tip: perf/urgent] " tip-bot2 for Namhyung Kim
-- strict thread matches above, loose matches on Subject: below --
2026-06-15 5:11 [PATCH RESEND] " Namhyung Kim
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®