Re: [PATCH] perf/core: Handling the race between exit_mmap and perf sample

[Peter Zijlstra <peterz@infradead.org>]

On Wed, Jun 04, 2025 at 03:05:43PM +0100, Mark Rutland wrote:

> Loooking at 5.15.149 and current HEAD (5abc7438f1e9), do_exit() calls
> exit_mm() before perf_event_exit_task(), so it looks
> like perf could sample from another task's mm.
> 
> Yuck.
> 
> Peter, does the above sound plausible to you?

Yuck indeed. And yeah, we should probably re-arrange things there.

Something like so?

---
diff --git a/kernel/exit.c b/kernel/exit.c
index 38645039dd8f..3407c16fc5a3 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -944,6 +944,15 @@ void __noreturn do_exit(long code)
 	taskstats_exit(tsk, group_dead);
 	trace_sched_process_exit(tsk, group_dead);
 
+	/*
+	 * Since samping can touch ->mm, make sure to stop everything before we
+	 * tear it down.
+	 *
+	 * Also flushes inherited counters to the parent - before the parent
+	 * gets woken up by child-exit notifications.
+	 */
+	perf_event_exit_task(tsk);
+
 	exit_mm();
 
 	if (group_dead)
@@ -959,14 +968,6 @@ void __noreturn do_exit(long code)
 	exit_task_work(tsk);
 	exit_thread(tsk);
 
-	/*
-	 * Flush inherited counters to the parent - before the parent
-	 * gets woken up by child-exit notifications.
-	 *
-	 * because of cgroup mode, must be called before cgroup_exit()
-	 */
-	perf_event_exit_task(tsk);
-
 	sched_autogroup_exit_task(tsk);
 	cgroup_exit(tsk);