The perf_iterate_ctx() function performs RCU list traversal but
currently lacks RCU read lock protection. This causes lockdep warnings
when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:

	WARNING: suspicious RCU usage
	kernel/events/core.c:8168 RCU-list traversed in non-reader section!!

	 Call Trace:
	  lockdep_rcu_suspicious
	  ? perf_event_addr_filters_apply
	  perf_iterate_ctx
	  perf_event_exec
	  begin_new_exec
	  ? load_elf_phdrs
	  load_elf_binary
	  ? lock_acquire
	  ? find_held_lock
	  ? bprm_execve
	  bprm_execve
	  do_execveat_common.isra.0
	  __x64_sys_execve
	  do_syscall_64
	  entry_SYSCALL_64_after_hwframe

This protection was previously present but was removed in commit
bd2756811766 ("perf: Rewrite core context handling"). Add back the
necessary rcu_read_lock()/rcu_read_unlock() pair around
perf_iterate_ctx() call in perf_event_exec().

CC: stable@vger.kernel.org
Fixes: bd2756811766 ("perf: Rewrite core context handling")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/events/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 065f9188b44a0d8ee66cc76314ae247dbe45cb57..e2adb06f8d81307b2762375474bee1c9e8a74598 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8277,7 +8277,9 @@ void perf_event_exec(void)
 
 	perf_event_enable_on_exec(ctx);
 	perf_event_remove_on_exec(ctx);
+	rcu_read_lock();
 	perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true);
+	rcu_read_unlock();
 
 	perf_unpin_context(ctx);
 	put_ctx(ctx);

---
base-commit: dbb0aea70ce4b85915a52d7adf9af57bd80f330a
change-id: 20250117-fix_perf_rcu-2ff93190950a

Best regards,
-- 
Breno Leitao <leitao@debian.org>

On Fri, Jan 17, 2025 at 06:41:07AM -0800, Breno Leitao wrote:
> The perf_iterate_ctx() function performs RCU list traversal but
> currently lacks RCU read lock protection. This causes lockdep warnings
> when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:
> 
> 	WARNING: suspicious RCU usage
> 	kernel/events/core.c:8168 RCU-list traversed in non-reader section!!
> 
> 	 Call Trace:
> 	  lockdep_rcu_suspicious
> 	  ? perf_event_addr_filters_apply
> 	  perf_iterate_ctx
> 	  perf_event_exec
> 	  begin_new_exec
> 	  ? load_elf_phdrs
> 	  load_elf_binary
> 	  ? lock_acquire
> 	  ? find_held_lock
> 	  ? bprm_execve
> 	  bprm_execve
> 	  do_execveat_common.isra.0
> 	  __x64_sys_execve
> 	  do_syscall_64
> 	  entry_SYSCALL_64_after_hwframe
> 
> This protection was previously present but was removed in commit
> bd2756811766 ("perf: Rewrite core context handling"). Add back the
> necessary rcu_read_lock()/rcu_read_unlock() pair around
> perf_iterate_ctx() call in perf_event_exec().

Hurm, I think it got ripped out because we no longer need to refer that
perf_event_ctxp[].

Anyway, please write it like so:


diff --git a/kernel/events/core.c b/kernel/events/core.c
index 0f8c55990783..b77f95089d62 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8320,7 +8320,8 @@ void perf_event_exec(void)
 
 	perf_event_enable_on_exec(ctx);
 	perf_event_remove_on_exec(ctx);
-	perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true);
+	scoped_guard(rcu)
+		perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true);
 
 	perf_unpin_context(ctx);
 	put_ctx(ctx);

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     0fe8813baf4b2e865d3b2c735ce1a15b86002c74
Gitweb:        https://git.kernel.org/tip/0fe8813baf4b2e865d3b2c735ce1a15b86002c74
Author:        Breno Leitao <leitao@debian.org>
AuthorDate:    Fri, 17 Jan 2025 06:41:07 -08:00
Committer:     Ingo Molnar <mingo@kernel.org>
CommitterDate: Mon, 24 Feb 2025 19:17:04 +01:00

perf/core: Add RCU read lock protection to perf_iterate_ctx()

The perf_iterate_ctx() function performs RCU list traversal but
currently lacks RCU read lock protection. This causes lockdep warnings
when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:

	WARNING: suspicious RCU usage
	kernel/events/core.c:8168 RCU-list traversed in non-reader section!!

	 Call Trace:
	  lockdep_rcu_suspicious
	  ? perf_event_addr_filters_apply
	  perf_iterate_ctx
	  perf_event_exec
	  begin_new_exec
	  ? load_elf_phdrs
	  load_elf_binary
	  ? lock_acquire
	  ? find_held_lock
	  ? bprm_execve
	  bprm_execve
	  do_execveat_common.isra.0
	  __x64_sys_execve
	  do_syscall_64
	  entry_SYSCALL_64_after_hwframe

This protection was previously present but was removed in commit
bd2756811766 ("perf: Rewrite core context handling"). Add back the
necessary rcu_read_lock()/rcu_read_unlock() pair around
perf_iterate_ctx() call in perf_event_exec().

[ mingo: Use scoped_guard() as suggested by Peter ]

Fixes: bd2756811766 ("perf: Rewrite core context handling")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250117-fix_perf_rcu-v1-1-13cb9210fc6a@debian.org
---
 kernel/events/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index bcb09e0..7dabbca 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8321,7 +8321,8 @@ void perf_event_exec(void)
 
 	perf_event_enable_on_exec(ctx);
 	perf_event_remove_on_exec(ctx);
-	perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true);
+	scoped_guard(rcu)
+		perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true);
 
 	perf_unpin_context(ctx);
 	put_ctx(ctx);