[PATCH v2] perf/core: Fix ITRACE start suppression for inherited events

[PATCH v2] perf/core: Fix ITRACE start suppression for inherited events

[Leo Yan]

perf_log_itrace_start() follows event->parent before checking
PERF_ATTACH_ITRACE, but perf_event_itrace_started() sets the flag on the
event passed by the PMU driver. If an inherited event starts tracing
before its parent, the parent's flag remains clear and the child emits
redundant ITRACE_START records on subsequent schedule-ins.

Follow event->parent in perf_event_itrace_started() as well, so that the
setter and checker use the same event. This preserves the original
suppression policy: ITRACE_START supplies the initial task context when
tracing begins, while subsequent task switches are tracked through
context-switch records or trace context packets.

Reported-by: Sashiko AI <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-perf-users/20260901164705.042781F000E9@smtp.kernel.org/
Fixes: 9a6694cfa239 ("perf/x86/intel/pt: Do not force sync packets on every schedule-in")
Signed-off-by: Leo Yan <leo.yan@arm.com>
---
Changes in v2:
- Changed setter to fetch parent event instead (James).
- Link to v1: https://lore.kernel.org/r/20260903-perf_core_itrace_start_fix_inherit_event-v1-1-6bff7e675af5@arm.com
---
 kernel/events/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 634d2ccbab82d8bfe9d1bd7f8c6745f60260dbd9..85d924cce387f88de0c1efe6c22754d38430c9d6 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10568,6 +10568,9 @@ void perf_event_text_poke(const void *addr, const void *old_bytes,
 
 void perf_event_itrace_started(struct perf_event *event)
 {
+	if (event->parent)
+		event = event->parent;
+
 	WRITE_ONCE(event->attach_state, event->attach_state | PERF_ATTACH_ITRACE);
 }
 

---
base-commit: 6f8319e3e9a44dd537d17f41565a8453c560a581
change-id: 20260903-perf_core_itrace_start_fix_inherit_event-a8930d792899

Best regards,
-- 
Leo Yan <leo.yan@arm.com>

Re: [PATCH v2] perf/core: Fix ITRACE start suppression for inherited events

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] perf/core: data race on attach_state via cross-context RMW
--

commit d3d316cfe645aab199ffb03f9db1a44478297ef1
Author: Leo Yan <leo.yan@arm.com>
Date:   Tue Sep 29 15:08:32 2026 +0000

perf/core: Fix ITRACE start suppression for inherited events

This commit modifies perf_event_itrace_started() to apply the
PERF_ATTACH_ITRACE flag to the parent event instead of the child event for
inherited events. This ensures that the setter and checker use the same
event to prevent redundant ITRACE_START records on subsequent schedule-ins.

Closes: https://lore.kernel.org/linux-perf-users/20260901164705.042781F000E9@smtp.kernel.org/
Fixes: 9a6694cfa239 ("perf/x86/intel/pt: Do not force sync packets on every schedule-in")

> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 634d2ccbab82d..85d924cce387f 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -10568,6 +10568,9 @@ void perf_event_text_poke(const void *addr, const void *old_bytes,
>  
>  void perf_event_itrace_started(struct perf_event *event)
>  {
> +	if (event->parent)
> +		event = event->parent;
> +
>  	WRITE_ONCE(event->attach_state, event->attach_state | PERF_ATTACH_ITRACE);

[Severity: High]
Does this introduce a cross-context read-modify-write data race on the shared
parent event's attach_state?

perf_event_itrace_started() is called from the PMU schedule-in path, holding
only the child's ctx->lock. It performs a lockless, non-atomic update on the
parent's attach_state.

Concurrently, the parent event might be undergoing teardown and modifying the
same attach_state field using non-atomic bitwise clears while holding the
parent's ctx->lock:

kernel/events/core.c:list_del_event() {
    ...
    event->attach_state &= ~PERF_ATTACH_CONTEXT;
    ...
}

Another concurrent update to the parent's attach_state occurs in
perf_group_detach():

kernel/events/core.c:perf_group_detach() {
    ...
    event->attach_state &= ~PERF_ATTACH_GROUP;
    ...
}

Because child events remain fully active and are detached only after the parent
is removed from its context, a child event can schedule in and race with the
parent's teardown.

Could this RMW race silently overwrite and resurrect bits that the parent
teardown just cleared?

If PERF_ATTACH_CONTEXT is resurrected, it seems it would bypass the
double-detach protection in list_del_event(), which is legitimately called
twice during exit() and close(). Would this result in integer underflow on
ctx->nr_events and list corruption from double list removals?

>  }
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929-perf_core_itrace_start_fix_inherit_event-v2-1-9361a946ed56@arm.com?part=1

Re: [PATCH v2] perf/core: Fix ITRACE start suppression for inherited events

[James Clark]

On 29/09/2026 16:08, Leo Yan wrote:
> perf_log_itrace_start() follows event->parent before checking
> PERF_ATTACH_ITRACE, but perf_event_itrace_started() sets the flag on the
> event passed by the PMU driver. If an inherited event starts tracing
> before its parent, the parent's flag remains clear and the child emits
> redundant ITRACE_START records on subsequent schedule-ins.
> 
> Follow event->parent in perf_event_itrace_started() as well, so that the
> setter and checker use the same event. This preserves the original
> suppression policy: ITRACE_START supplies the initial task context when
> tracing begins, while subsequent task switches are tracked through
> context-switch records or trace context packets.
> 
> Reported-by: Sashiko AI <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/linux-perf-users/20260901164705.042781F000E9@smtp.kernel.org/
> Fixes: 9a6694cfa239 ("perf/x86/intel/pt: Do not force sync packets on every schedule-in")
> Signed-off-by: Leo Yan <leo.yan@arm.com>
> ---
> Changes in v2:
> - Changed setter to fetch parent event instead (James).
> - Link to v1: https://lore.kernel.org/r/20260903-perf_core_itrace_start_fix_inherit_event-v1-1-6bff7e675af5@arm.com
> ---
>   kernel/events/core.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 634d2ccbab82d8bfe9d1bd7f8c6745f60260dbd9..85d924cce387f88de0c1efe6c22754d38430c9d6 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -10568,6 +10568,9 @@ void perf_event_text_poke(const void *addr, const void *old_bytes,
>   
>   void perf_event_itrace_started(struct perf_event *event)
>   {
> +	if (event->parent)
> +		event = event->parent;
> +
>   	WRITE_ONCE(event->attach_state, event->attach_state | PERF_ATTACH_ITRACE);
>   }
>   
> 
> ---
> base-commit: 6f8319e3e9a44dd537d17f41565a8453c560a581
> change-id: 20260903-perf_core_itrace_start_fix_inherit_event-a8930d792899
> 
> Best regards,

Reviewed-by: James Clark <james.clark@linaro.org>