[PATCH 7.1.y] Revert "tracing: perf: Fix stale head for perf syscall tracing"

[PATCH 7.1.y] Revert "tracing: perf: Fix stale head for perf syscall tracing"

[Peter Jung]

This reverts commit be94a3a77e7eb99c53418de7d4a01bc7eb3f634e.

The upstream commit was applied after commit 57918341dd19 ("bpf: Add
sleepable support for classic tracepoint programs"), which moved BPF
program execution before the per-CPU perf event list is checked.

The 7.1.y implementation has not undergone that restructuring. It handles
BPF and perf consumers together, and already reloads the current CPU's
perf event list after syscall_get_data().

As a result, the backport adds an unconditional hlist_empty() return before
bpf_prog_array_valid() is consulted. A syscall trace event can have a valid
BPF program array while the current CPU's perf event list is empty. In that
case the early return prevents the BPF program from running.

This breaks BPF consumers of faultable syscall-enter tracepoints such as
sys_enter_execve. One observed consequence is that Proton VPN's app-based
split tunneling no longer receives exec argument events and therefore
cannot match newly started processes.

Revert the stable backport. The existing head assignment below the removed
block preserves its intended stale-head protection while retaining the
previous BPF-aware handling.

Fixes: be94a3a77e7e ("tracing: perf: Fix stale head for perf syscall tracing")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Peter Jung <admin@ptr1337.dev>
---
 kernel/trace/trace_syscalls.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 8dcedff8429a..8ad72e17d8eb 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -1436,11 +1436,6 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
 		if (syscall_get_data(sys_data, args, &user_ptr,
 				     &size, user_sizes, &uargs, buf_size) < 0)
 			return;
-
-		/* The above may have caused a migration */
-		head = this_cpu_ptr(sys_data->enter_event->perf_events);
-		if (hlist_empty(head))
-			return;
 	}
 
 	head = this_cpu_ptr(sys_data->enter_event->perf_events);
-- 
2.51.0

Re: [PATCH 7.1.y] Revert "tracing: perf: Fix stale head for perf syscall tracing"

[Steven Rostedt]

On Sun, 16 Aug 2026 15:31:01 +0200
Peter Jung <admin@ptr1337.dev> wrote:

> This reverts commit be94a3a77e7eb99c53418de7d4a01bc7eb3f634e.
> 
> The upstream commit was applied after commit 57918341dd19 ("bpf: Add
> sleepable support for classic tracepoint programs"), which moved BPF
> program execution before the per-CPU perf event list is checked.
> 
> The 7.1.y implementation has not undergone that restructuring. It handles
> BPF and perf consumers together, and already reloads the current CPU's
> perf event list after syscall_get_data().
> 
> As a result, the backport adds an unconditional hlist_empty() return before
> bpf_prog_array_valid() is consulted. A syscall trace event can have a valid
> BPF program array while the current CPU's perf event list is empty. In that
> case the early return prevents the BPF program from running.
> 
> This breaks BPF consumers of faultable syscall-enter tracepoints such as
> sys_enter_execve. One observed consequence is that Proton VPN's app-based
> split tunneling no longer receives exec argument events and therefore
> cannot match newly started processes.
> 
> Revert the stable backport. The existing head assignment below the removed
> block preserves its intended stale-head protection while retaining the
> previous BPF-aware handling.


OK, so the Fixes on the original commit be94a3a77e7e should have had:

Fixes: 57918341dd19 ("bpf: Add sleepable support for classic tracepoint programs")

Instead?

-- Steve


> 
> Fixes: be94a3a77e7e ("tracing: perf: Fix stale head for perf syscall tracing")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Peter Jung <admin@ptr1337.dev>
> ---
>  kernel/trace/trace_syscalls.c | 5 -----
>  1 file changed, 5 deletions(-)
> 
> diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
> index 8dcedff8429a..8ad72e17d8eb 100644
> --- a/kernel/trace/trace_syscalls.c
> +++ b/kernel/trace/trace_syscalls.c
> @@ -1436,11 +1436,6 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
>  		if (syscall_get_data(sys_data, args, &user_ptr,
>  				     &size, user_sizes, &uargs, buf_size) < 0)
>  			return;
> -
> -		/* The above may have caused a migration */
> -		head = this_cpu_ptr(sys_data->enter_event->perf_events);
> -		if (hlist_empty(head))
> -			return;
>  	}
>  
>  	head = this_cpu_ptr(sys_data->enter_event->perf_events);

Re: [PATCH 7.1.y] Revert "tracing: perf: Fix stale head for perf syscall tracing"

[Peter Jung]

On 8/16/26 16:57, Steven Rostedt wrote:
> On Sun, 16 Aug 2026 15:31:01 +0200
> Peter Jung<admin@ptr1337.dev> wrote:
> 
>> This reverts commit be94a3a77e7eb99c53418de7d4a01bc7eb3f634e.
>>
>> The upstream commit was applied after commit 57918341dd19 ("bpf: Add
>> sleepable support for classic tracepoint programs"), which moved BPF
>> program execution before the per-CPU perf event list is checked.
>>
>> The 7.1.y implementation has not undergone that restructuring. It handles
>> BPF and perf consumers together, and already reloads the current CPU's
>> perf event list after syscall_get_data().
>>
>> As a result, the backport adds an unconditional hlist_empty() return before
>> bpf_prog_array_valid() is consulted. A syscall trace event can have a valid
>> BPF program array while the current CPU's perf event list is empty. In that
>> case the early return prevents the BPF program from running.
>>
>> This breaks BPF consumers of faultable syscall-enter tracepoints such as
>> sys_enter_execve. One observed consequence is that Proton VPN's app-based
>> split tunneling no longer receives exec argument events and therefore
>> cannot match newly started processes.
>>
>> Revert the stable backport. The existing head assignment below the removed
>> block preserves its intended stale-head protection while retaining the
>> previous BPF-aware handling.
> 
> OK, so the Fixes on the original commit be94a3a77e7e should have had:
> 
> Fixes: 57918341dd19 ("bpf: Add sleepable support for classic tracepoint programs")
> 
> Instead?
> 
> -- Steve
> 

Yes, this should fix it too, but has been not verified yet. I will run a 
test tomorrow and let you know.

Best,

Peter

> 
>> Fixes: be94a3a77e7e ("tracing: perf: Fix stale head for perf syscall tracing")
>> Cc:stable@vger.kernel.org
>> Assisted-by:Codex:gpt-5.6-sol
>> Signed-off-by: Peter Jung<admin@ptr1337.dev>
>> ---
>>   kernel/trace/trace_syscalls.c | 5 -----
>>   1 file changed, 5 deletions(-)
>>
>> diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
>> index 8dcedff8429a..8ad72e17d8eb 100644
>> --- a/kernel/trace/trace_syscalls.c
>> +++ b/kernel/trace/trace_syscalls.c
>> @@ -1436,11 +1436,6 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
>>   		if (syscall_get_data(sys_data, args, &user_ptr,
>>   				     &size, user_sizes, &uargs, buf_size) < 0)
>>   			return;
>> -
>> -		/* The above may have caused a migration */
>> -		head = this_cpu_ptr(sys_data->enter_event->perf_events);
>> -		if (hlist_empty(head))
>> -			return;
>>   	}
>>   
>>   	head = this_cpu_ptr(sys_data->enter_event->perf_events);
>