Re: [PATCH] s390/pai: Prevent ioctl(PERF_EVENT_IOC_REFRESH)

[Heiko Carstens <hca@linux.ibm.com>]

On Mon, Aug 31, 2026 at 11:45:57AM +0200, Thomas Richter wrote:
> On 8/27/26 08:57, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > - [High] Unprotected modification of core perf_event state (pending_kill, event_limit) causes data races, dropped signals, and silently breaks the PERF_EVENT_IOC_REFRESH API.
...
> >> diff --git a/arch/s390/kernel/perf_pai.c b/arch/s390/kernel/perf_pai.c
> >> index cdb8006220ca0..e43b2f1c94471 100644
> >> --- a/arch/s390/kernel/perf_pai.c
> >> +++ b/arch/s390/kernel/perf_pai.c
> >> @@ -658,6 +658,8 @@ static void pai_have_sample(struct perf_event *event, struct pai_map *cpump)
> >>  
> >>  	if (!event)		/* No event active */
> >>  		return;
> >> +	event->pending_kill = 0;	/* prevent ioctl(IOC_REFRESH) */
> >> +	atomic_set(&event->event_limit, 0);
> > 
> > [Severity: High]
> > Does this unprotected modification of core perf_event state (pending_kill,
> > event_limit) cause data races, dropped signals, and silently break the
> > PERF_EVENT_IOC_REFRESH API?
> > 
> > Bypassing core perf locking rules to directly mutate event_limit and
> > pending_kill causes data races, silently drops pending SIGIO signals, and
> > breaks the API contract. The ioctl will return success, but userspace will
> > never receive the requested signal, leading to application hangs.
> 
> A: The PERF_EVENT_IOC_REFRESH API is disabled on purpose. The PAI PMU
>    relies on data collection on schedule out of a task. This is
>    done by design. Invoking ioctl(fd, PERF_EVENT_IOC_REFRESH API, X)
>    breaks this behavior and should be blocked.
> 
>    The modifications of members perf_event::event_limit and
>    perf_event::pending_kill are protected. The invocation
>    is triggered by the schedule out path and protected via
>    perf_pmu_sched_task()
>    +--> __perf_pmu_sched_task()
>         +--> perf_ctx_lock()
> 
>    This locks the event and protects the states of the event.
> 
> > 
> > If a userspace application calls ioctl(fd, PERF_EVENT_IOC_REFRESH, N) on a
> > PAI event, and concurrently, a context switch calls pai_have_sample(),
> > writing to event_limit will race with atomic_add() in the core subsystem,
> > and clearing pending_kill will race with perf_event_wakeup().
> 
> This requires a common code change to block an ioctl(fd, PERF_EVENT_IOC_REFRESH, N)
> similar to the PMU check_period call back function.

The above looks like a layering violation to me. Please resend with common
code maintainers on cc, so they can yell if this is not acceptable.