* [PATCH] perf: avoid lockdep warning in self-monitoring perf_event_open
@ 2026-06-07 16:26 l1za0.sec
2026-06-07 16:36 ` sashiko-bot
0 siblings, 1 reply; 2+ messages in thread
From: l1za0.sec @ 2026-06-07 16:26 UTC (permalink / raw)
To: peterz, mingo, acme, namhyung
Cc: mark.rutland, alexander.shishkin, jolsa, irogers, adrian.hunter,
james.clark, linux-perf-users, linux-kernel
From: Haocheng Yu <l1za0.sec@gmail.com>
A lockdep warning: possible deadlock in __perf_event_task_sched_out is
reported by a modified Syzkaller-based kernel fuzzing tool we use.
The warning is triggered on the self-monitoring perf_event_open() path.
When perf_install_in_context() targets the current task, it goes through
task_function_call() and the synchronous smp_call_function_single()
self-call path. The reported lockdep chain contains:
rq->__lock -> ctx->lock
and an existing reverse dependency from:
ctx->lock -> ... -> p->pi_lock -> rq->__lock
The current fix adds a fast path for task == current in
perf_install_in_context() and calls __perf_install_in_context()
directly.
This fix removes the self-call path for the reported self-monitoring
case. It does not change the scheduler-side locking order in
__perf_event_task_sched_out(), so it should be treated as a targeted
mitigation for this trigger path.
Signed-off-by: Haocheng Yu <l1za0.sec@gmail.com>
---
The full report:
syz.5.416/15637 is trying to acquire lock:
ffff888110979418 (&ctx->lock){....}-{2:2}, at: perf_event_context_sched_out kernel/events/core.c:3848 [inline]
ffff888110979418 (&ctx->lock){....}-{2:2}, at: __perf_event_task_sched_out+0x439/0x14e0 kernel/events/core.c:3953
but task is already holding lock:
ffff888135f3b3e0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2e/0x170 kernel/sched/core.c:652
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #5 (&rq->__lock){-.-.}-{2:2}:
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b0/0x360 kernel/locking/lockdep.c:5825
_raw_spin_lock_nested+0x34/0x40 kernel/locking/spinlock.c:382
raw_spin_rq_lock_nested+0x2e/0x170 kernel/sched/core.c:652
raw_spin_rq_lock kernel/sched/sched.h:1624 [inline]
_task_rq_lock+0xd3/0x4b0 kernel/sched/core.c:747
cgroup_move_task+0x72/0x310 kernel/sched/psi.c:1170
css_set_move_task+0x277/0x550 kernel/cgroup/cgroup.c:887
cgroup_post_fork+0x1ff/0x970 kernel/cgroup/cgroup.c:6952
copy_process+0x4869/0x7e30 kernel/fork.c:2524
kernel_clone+0x11a/0xf30 kernel/fork.c:2721
user_mode_thread+0xc8/0x110 kernel/fork.c:2797
rest_init+0x23/0x2f0 init/main.c:727
start_kernel+0x409/0x4e0 init/main.c:1220
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x101/0x150 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x148
-> #4 (&p->pi_lock){-.-.}-{2:2}:
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b0/0x360 kernel/locking/lockdep.c:5825
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:166
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:571 [inline]
try_to_wake_up+0xb7/0x2220 kernel/sched/core.c:4190
autoremove_wake_function+0x16/0x150 kernel/sched/wait.c:403
__wake_up_common+0x138/0x1f0 kernel/sched/wait.c:108
__wake_up_common_lock+0x33/0x60 kernel/sched/wait.c:125
tty_port_default_wakeup+0x4d/0x70 drivers/tty/tty_port.c:67
serial8250_tx_chars+0xa6f/0x1200 drivers/tty/serial/8250/8250_port.c:1721
serial8250_handle_irq_locked+0x55f/0xcd0 drivers/tty/serial/8250/8250_port.c:1825
serial8250_handle_irq.part.0+0xb6/0x540 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1837 [inline]
serial8250_default_handle_irq+0xbf/0x150 drivers/tty/serial/8250/8250_port.c:1855
serial8250_interrupt+0xf8/0x1c0 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x242/0x8f0 kernel/irq/handle.c:209
handle_irq_event_percpu+0x18/0xe0 kernel/irq/handle.c:246
handle_irq_event+0xa5/0x140 kernel/irq/handle.c:263
handle_edge_irq+0x25c/0x760 kernel/irq/chip.c:856
generic_handle_irq_desc include/linux/irqdesc.h:186 [inline]
handle_irq arch/x86/kernel/irq.c:262 [inline]
call_irq_handler arch/x86/kernel/irq.c:286 [inline]
__common_interrupt+0xd1/0x2f0 arch/x86/kernel/irq.c:333
common_interrupt+0xf2/0x110 arch/x86/kernel/irq.c:326
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
lowmem_page_address include/linux/mm.h:2973 [inline]
kmap_local_page include/linux/highmem-internal.h:188 [inline]
clear_highpage_kasan_tagged include/linux/highmem.h:342 [inline]
kernel_init_pages+0x79/0xc0 mm/page_alloc.c:1218
post_alloc_hook mm/page_alloc.c:1856 [inline]
prep_new_page+0x19d/0x1d0 mm/page_alloc.c:1866
get_page_from_freelist+0x1605/0x3280 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x339/0x780 mm/page_alloc.c:5226
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab mm/slub.c:3467 [inline]
new_slab+0x9c/0x670 mm/slub.c:3525
refill_objects+0x254/0x400 mm/slub.c:7251
refill_sheaf+0x27/0x40 mm/slub.c:2816
__pcs_replace_empty_main+0x191/0x5f0 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
__do_kmalloc_node mm/slub.c:5294 [inline]
__kmalloc_noprof+0x7b5/0x970 mm/slub.c:5307
kmalloc_noprof include/linux/slab.h:954 [inline]
tomoyo_realpath_from_path+0xc3/0x600 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x235/0x440 security/tomoyo/file.c:827
security_inode_getattr+0x122/0x2b0 security/security.c:1895
vfs_getattr+0x26/0x70 fs/stat.c:259
vfs_statx_path fs/stat.c:299 [inline]
vfs_statx+0x125/0x3f0 fs/stat.c:356
vfs_fstatat+0x77/0xe0 fs/stat.c:373
vfs_lstat include/linux/fs.h:3212 [inline]
__do_sys_newlstat+0x83/0x100 fs/stat.c:524
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x121/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #3 (&tty->write_wait){-.-.}-{3:3}:
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b0/0x360 kernel/locking/lockdep.c:5825
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:166
__wake_up_common_lock+0x1d/0x60 kernel/sched/wait.c:124
tty_port_default_wakeup+0x4d/0x70 drivers/tty/tty_port.c:67
serial8250_tx_chars+0xa6f/0x1200 drivers/tty/serial/8250/8250_port.c:1721
serial8250_handle_irq_locked+0x55f/0xcd0 drivers/tty/serial/8250/8250_port.c:1825
serial8250_handle_irq.part.0+0xb6/0x540 drivers/tty/serial/8250/8250_port.c:1841
serial8250_handle_irq drivers/tty/serial/8250/8250_port.c:1837 [inline]
serial8250_default_handle_irq+0xbf/0x150 drivers/tty/serial/8250/8250_port.c:1855
serial8250_interrupt+0xf8/0x1c0 drivers/tty/serial/8250/8250_core.c:86
__handle_irq_event_percpu+0x242/0x8f0 kernel/irq/handle.c:209
handle_irq_event_percpu+0x18/0xe0 kernel/irq/handle.c:246
handle_irq_event+0xa5/0x140 kernel/irq/handle.c:263
handle_edge_irq+0x25c/0x760 kernel/irq/chip.c:856
generic_handle_irq_desc include/linux/irqdesc.h:186 [inline]
handle_irq arch/x86/kernel/irq.c:262 [inline]
call_irq_handler arch/x86/kernel/irq.c:286 [inline]
__common_interrupt+0xd1/0x2f0 arch/x86/kernel/irq.c:333
common_interrupt+0xf2/0x110 arch/x86/kernel/irq.c:326
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
_raw_spin_unlock_irqrestore+0x3c/0x70 kernel/locking/spinlock.c:198
spin_unlock_irqrestore include/linux/spinlock.h:408 [inline]
uart_port_unlock_irqrestore include/linux/serial_core.h:788 [inline]
uart_port_unlock_deref drivers/tty/serial/serial_core.c:91 [inline]
uart_port_unlock_deref drivers/tty/serial/serial_core.c:88 [inline]
uart_write+0x289/0xb10 drivers/tty/serial/serial_core.c:634
do_output_char+0x5e8/0x870 drivers/tty/n_tty.c:418
process_output drivers/tty/n_tty.c:482 [inline]
n_tty_write+0x507/0x10a0 drivers/tty/n_tty.c:2377
iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
file_tty_write.isra.0+0x4de/0x920 drivers/tty/tty_io.c:1081
tty_write drivers/tty/tty_io.c:1102 [inline]
redirected_tty_write drivers/tty/tty_io.c:1125 [inline]
redirected_tty_write+0xc9/0x100 drivers/tty/tty_io.c:1105
do_iter_readv_writev+0x655/0x9e0 fs/read_write.c:829
vfs_writev+0x30c/0xd70 fs/read_write.c:1059
do_writev+0x129/0x330 fs/read_write.c:1105
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x121/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #2 (&port_lock_key){-.-.}-{3:3}:
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b0/0x360 kernel/locking/lockdep.c:5825
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:166
uart_port_lock_irqsave include/linux/serial_core.h:717 [inline]
serial8250_console_write+0x553/0x1700 drivers/tty/serial/8250/8250_port.c:3316
console_emit_next_record kernel/printk/printk.c:3183 [inline]
console_flush_one_record+0x7ae/0xe80 kernel/printk/printk.c:3269
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x224/0x530 kernel/printk/printk.c:3413
vprintk_emit+0x46a/0xa30 kernel/printk/printk.c:2479
_printk+0xbe/0xf0 kernel/printk/printk.c:2504
register_console+0x7f0/0x11c0 kernel/printk/printk.c:4208
univ8250_console_init+0x62/0x90 drivers/tty/serial/8250/8250_core.c:515
console_init+0xc7/0x6d0 kernel/printk/printk.c:4407
start_kernel+0x2b2/0x4e0 init/main.c:1157
x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x101/0x150 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x148
-> #1 (console_owner){....}-{0:0}:
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b0/0x360 kernel/locking/lockdep.c:5825
console_lock_spinning_enable+0x72/0x80 kernel/printk/printk.c:1902
console_emit_next_record kernel/printk/printk.c:3177 [inline]
console_flush_one_record+0x757/0xe80 kernel/printk/printk.c:3269
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x224/0x530 kernel/printk/printk.c:3413
vprintk_emit+0x46a/0xa30 kernel/printk/printk.c:2479
_printk+0xbe/0xf0 kernel/printk/printk.c:2504
ex_handler_msr+0x3c4/0x540 arch/x86/mm/extable.c:170
fixup_exception+0x119/0x10a0 arch/x86/mm/extable.c:347
gp_try_fixup_and_notify.constprop.0+0x2e/0x130 arch/x86/kernel/traps.c:888
__exc_general_protection arch/x86/kernel/traps.c:949 [inline]
exc_general_protection+0x1b6/0x320 arch/x86/kernel/traps.c:914
asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:612
__wrmsrq arch/x86/include/asm/msr.h:80 [inline]
native_write_msr arch/x86/include/asm/msr.h:137 [inline]
wrmsrq arch/x86/include/asm/msr.h:199 [inline]
__x86_pmu_enable_event arch/x86/events/perf_event.h:1283 [inline]
intel_pmu_enable_event+0xea6/0x1340 arch/x86/events/intel/core.c:3309
x86_pmu_start+0x19a/0x220 arch/x86/events/core.c:1553
x86_pmu_enable+0x642/0xf60 arch/x86/events/core.c:1386
perf_pmu_enable kernel/events/core.c:1355 [inline]
perf_pmu_enable+0x113/0x160 kernel/events/core.c:1351
ctx_resched+0x382/0x460 kernel/events/core.c:3031
__perf_install_in_context+0x9a9/0xe60 kernel/events/core.c:3099
remote_function kernel/events/core.c:95 [inline]
remote_function+0x128/0x1b0 kernel/events/core.c:75
csd_do_func kernel/smp.c:136 [inline]
generic_exec_single+0x230/0x730 kernel/smp.c:453
smp_call_function_single+0x196/0x610 kernel/smp.c:699
task_function_call+0xe4/0x170 kernel/events/core.c:123
perf_install_in_context+0x2cb/0x570 kernel/events/core.c:3202
__do_sys_perf_event_open+0x17ab/0x2a00 kernel/events/core.c:14162
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x121/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (&ctx->lock){....}-{2:2}:
check_prev_add+0xe9/0xd00 kernel/locking/lockdep.c:3165
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x14e8/0x24e0 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b0/0x360 kernel/locking/lockdep.c:5825
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
perf_event_context_sched_out kernel/events/core.c:3848 [inline]
__perf_event_task_sched_out+0x439/0x14e0 kernel/events/core.c:3953
perf_event_task_sched_out include/linux/perf_event.h:1662 [inline]
prepare_task_switch kernel/sched/core.c:5175 [inline]
context_switch kernel/sched/core.c:5332 [inline]
__schedule+0x3091/0x7fd0 kernel/sched/core.c:7188
preempt_schedule_common+0x49/0xc0 kernel/sched/core.c:7369
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
smp_call_function_single+0x54b/0x610 kernel/smp.c:704
task_function_call+0xe4/0x170 kernel/events/core.c:123
perf_install_in_context+0x2cb/0x570 kernel/events/core.c:3202
__do_sys_perf_event_open+0x17ab/0x2a00 kernel/events/core.c:14162
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x121/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
&ctx->lock --> &p->pi_lock --> &rq->__lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&rq->__lock);
lock(&p->pi_lock);
lock(&rq->__lock);
lock(&ctx->lock);
*** DEADLOCK ***
The reproducer:
# {Threaded:false Repeat:true RepeatTimes:0 Procs:8 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f00000002c0)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x6}}, 0x10)
sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44}, 0x60000084)
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000002c0), 0x13f, 0x9}}, 0x20)
pkey_mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xc, 0xffffffffffffffff)
perf_event_open(&(0x7f00000002c0)={0x5, 0x80, 0x40, 0x7, 0x7, 0xff, 0x0, 0x5, 0x180a08, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_config_ext={0xf933, 0x3}, 0x1dec1, 0x246, 0x1, 0x5, 0xfffffffffffffff7, 0xffffffff, 0x6, 0x0, 0x6, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2)
kernel/events/core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7935d5663944..6e689f2dafbd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3199,6 +3199,10 @@ perf_install_in_context(struct perf_event_context *ctx,
*/
smp_mb();
again:
+ if (task == current) {
+ __perf_install_in_context(event);
+ return;
+ }
if (!task_function_call(task, __perf_install_in_context, event))
return;
base-commit: 33d8d8ec31b591952ded59d596c2f3db45004937
--
2.51.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] perf: avoid lockdep warning in self-monitoring perf_event_open
2026-06-07 16:26 [PATCH] perf: avoid lockdep warning in self-monitoring perf_event_open l1za0.sec
@ 2026-06-07 16:36 ` sashiko-bot
0 siblings, 0 replies; 2+ messages in thread
From: sashiko-bot @ 2026-06-07 16:36 UTC (permalink / raw)
To: l1za0.sec; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Hard deadlock and unsafe `this_cpu_ptr()` usage due to bypass of IPI context in `perf_install_in_context()`.
--
commit edfe32c20b9adaadf4bb22117c091b1b0e31a92d
Author: Haocheng Yu <l1za0.sec@gmail.com>
perf: avoid lockdep warning in self-monitoring perf_event_open
This commit attempts to fix a lockdep warning by adding a fast path for
self-monitoring in perf_install_in_context(). It directly calls
__perf_install_in_context() instead of using task_function_call() when the
target task is current.
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 7935d5663944e..6e689f2dafbd9 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
[ ... ]
> @@ -3199,6 +3199,10 @@ perf_install_in_context(struct perf_event_context *ctx,
> */
> smp_mb();
> again:
> + if (task == current) {
> + __perf_install_in_context(event);
> + return;
> + }
[Severity: High]
Does this direct call to __perf_install_in_context() introduce a regression
by running with preemption and interrupts enabled?
Since perf_install_in_context() only holds ctx->mutex here, preemption and
interrupts are still active. When __perf_install_in_context() is called
directly instead of via IPI, it executes:
kernel/events/core.c:__perf_install_in_context() {
...
struct perf_cpu_context *cpuctx = this_cpu_ptr(&perf_cpu_context);
...
}
Will this trigger a warning for using this_cpu_ptr() in preemptible context,
and potentially allow the task to migrate and corrupt per-CPU data?
Additionally, __perf_install_in_context() acquires locks without disabling
interrupts:
kernel/events/core.c:__perf_install_in_context() {
...
raw_spin_lock(&cpuctx->ctx.lock);
if (ctx->task) {
raw_spin_lock(&ctx->lock);
...
}
If a hardware PMU interrupt or a timer tick (like perf_event_task_tick())
fires on the same CPU while these locks are held, could this regression
result in a hard deadlock when the interrupt handler attempts to acquire
them again?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260607162622.15534-1-l1za0.sec@gmail.com?part=1
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-07 16:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-07 16:26 [PATCH] perf: avoid lockdep warning in self-monitoring perf_event_open l1za0.sec
2026-06-07 16:36 ` sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox