From: Deepanshu Kartikey <kartikey406@gmail.com>
To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org,
namhyung@kernel.org, mark.rutland@arm.com,
alexander.shishkin@linux.intel.com, jolsa@kernel.org,
irogers@google.com, adrian.hunter@intel.com,
james.clark@linaro.org, song@kernel.org, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com,
memxor@gmail.com, martin.lau@linux.dev, yonghong.song@linux.dev,
emil@etsalapatis.com, kpsingh@kernel.org,
mattbobrowski@google.com, rostedt@goodmis.org,
mhiramat@kernel.org, mathieu.desnoyers@efficios.com,
me@kylehuey.com
Cc: linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org,
bpf@vger.kernel.org, linux-trace-kernel@vger.kernel.org,
Deepanshu Kartikey <kartikey406@gmail.com>,
syzbot+651d2774bd1d8395595f@syzkaller.appspotmail.com
Subject: [PATCH] perf/bpf: Fix data race in __perf_event_overflow
Date: Wed, 12 Aug 2026 05:23:31 +0530 [thread overview]
Message-ID: <20260811235331.10044-1-kartikey406@gmail.com> (raw)
perf_event_detach_bpf_prog() writes event->prog = NULL
under bpf_event_mutex, while __perf_event_overflow() reads
event->prog concurrently without any lock protection. This
causes a data race detected by KCSAN.
__perf_event_overflow() can be called from interrupt/NMI
context, so it cannot acquire bpf_event_mutex. Fix the race
by using WRITE_ONCE() in perf_event_detach_bpf_prog() and
READ_ONCE() in __perf_event_overflow(). Also store the result
of READ_ONCE() in a local variable to avoid reading event->prog
twice which could result in a NULL pointer dereference if the
pointer becomes NULL between the two reads.
Reported-by: syzbot+651d2774bd1d8395595f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=651d2774bd1d8395595f
Fixes: f11f10bfa1ca ("perf/bpf: Call BPF handler directly, not through overflow machinery")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/events/core.c | 4 +++-
kernel/trace/bpf_trace.c | 2 +-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index ba5bd6a78fe7..9d9c5477772e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10753,6 +10753,7 @@ static int __perf_event_overflow(struct perf_event *event,
{
int events = atomic_read(&event->event_limit);
int ret = 0;
+ struct bpf_prog *prog;
/*
* Non-sampling counters might still use the PMI to fold short
@@ -10766,7 +10767,8 @@ static int __perf_event_overflow(struct perf_event *event,
if (event->attr.aux_pause)
perf_event_aux_pause(event->aux_event, true);
- if (event->prog && event->prog->type == BPF_PROG_TYPE_PERF_EVENT &&
+ prog = READ_ONCE(event->prog);
+ if (prog && prog->type == BPF_PROG_TYPE_PERF_EVENT &&
!bpf_overflow_handler(event, data, regs))
goto out;
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 75495a5c3507..ee61dc760045 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2018,7 +2018,7 @@ void perf_event_detach_bpf_prog(struct perf_event *event)
put:
prog = event->prog;
- event->prog = NULL;
+ WRITE_ONCE(event->prog, NULL);
unlock:
mutex_unlock(&bpf_event_mutex);
--
2.43.0
next reply other threads:[~2026-08-11 23:53 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-11 23:53 Deepanshu Kartikey [this message]
2026-08-12 0:08 ` [PATCH] perf/bpf: Fix data race in __perf_event_overflow sashiko-bot
2026-08-12 1:04 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260811235331.10044-1-kartikey406@gmail.com \
--to=kartikey406@gmail.com \
--cc=acme@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=irogers@google.com \
--cc=james.clark@linaro.org \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=martin.lau@linux.dev \
--cc=mathieu.desnoyers@efficios.com \
--cc=mattbobrowski@google.com \
--cc=me@kylehuey.com \
--cc=memxor@gmail.com \
--cc=mhiramat@kernel.org \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=song@kernel.org \
--cc=syzbot+651d2774bd1d8395595f@syzkaller.appspotmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox