linux-kernel - Re: [PATCH] perf/core: Fix WARN in perf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250709094451.GI1613200@noisy.programming.kicks-ass.net>
Date: Wed, 9 Jul 2025 11:44:51 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc: syzbot <syzbot+2fe61cb2a86066be6985@...kaller.appspotmail.com>,
	linux-perf-users@...r.kernel.org,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] perf/core: Fix WARN in perf_sigtrap()

On Sat, Jul 05, 2025 at 11:43:37PM +0900, Tetsuo Handa wrote:
> Since commit 4f6fc7821283 ("perf: Fix sample vs do_exit()") has moved
> perf_event_exit_task() call from after exit_task_work() to before
> exit_task_work(), 

> task_work_add() from perf_event_exit_task() now returns

There is no task_work_add() in perf_event_exit_task().

> 0 than -ESRCH, despite perf_event_exit_task_context() updates ctx->task
> to TASK_TOMBSTONE. As a result, event->ctx->task == current assumption
> no longer holds.

This changelog is confusing to the point that I've no idea what it is
trying to tell me.


Did you mean to say something like:

Because exit_task_work() now runs after perf_event_exit_task(), it is
possible for an already queued perf_pending_task()->perf_sigtrap() to
observe a dead task context.

> Reported-by: syzbot <syzbot+2fe61cb2a86066be6985@...kaller.appspotmail.com>
> Closes: https://syzkaller.appspot.com/bug?extid=2fe61cb2a86066be6985
> Fixes: 4f6fc7821283 ("perf: Fix sample vs do_exit()")
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> ---
> #syz test
> 
>  kernel/events/core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 7281230044d0..489f42defe3c 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -7208,7 +7208,8 @@ static void perf_sigtrap(struct perf_event *event)
>  	 * ctx->task or current has changed in the meantime. This can be the
>  	 * case on architectures that do not implement arch_irq_work_raise().
>  	 */
> -	if (WARN_ON_ONCE(event->ctx->task != current))
> +	if (WARN_ON_ONCE(event->ctx->task != current &&
> +			 event->ctx->task != TASK_TOMBSTONE))
>  		return;
>  

Also, isn't it better to simply swap the early exit tests in that
function like so:


diff --git a/kernel/events/core.c b/kernel/events/core.c
index 0db36b2b2448..22fdf0c187cd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7203,6 +7203,13 @@ void perf_event_wakeup(struct perf_event *event)
 
 static void perf_sigtrap(struct perf_event *event)
 {
+	/*
+	 * Both perf_pending_task() and perf_pending_irq() can race with the
+	 * task exiting.
+	 */
+	if (current->flags & PF_EXITING)
+		return;
+
 	/*
 	 * We'd expect this to only occur if the irq_work is delayed and either
 	 * ctx->task or current has changed in the meantime. This can be the
@@ -7211,13 +7218,6 @@ static void perf_sigtrap(struct perf_event *event)
 	if (WARN_ON_ONCE(event->ctx->task != current))
 		return;
 
-	/*
-	 * Both perf_pending_task() and perf_pending_irq() can race with the
-	 * task exiting.
-	 */
-	if (current->flags & PF_EXITING)
-		return;
-
 	send_sig_perf((void __user *)event->pending_addr,
 		      event->orig_type, event->attr.sig_data);
 }