From nobody Thu Dec 18 07:57:19 2025 Received: from mail-pl1-f196.google.com (mail-pl1-f196.google.com [209.85.214.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 657A61B81D3 for ; Tue, 9 Dec 2025 04:16:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765253779; cv=none; b=ho+a2OdK0+iCAzAj/PLuXv9Sg+UqtsT5C6w9rTWoFTVqushmP+qf7hASpGE68q+0wV2ixLTkxbMKElYR8EnjAKp/fJBgJXSkCXmf1HyUgLZiKRi2D8sS9KmbBgkdkhYDVgbNhS5qnhyQvMqIyPvtYqt7g2uIlN/l+Y66kfHcGlE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765253779; c=relaxed/simple; bh=ywL2XffooPaoJtOW52uoNolWTfO4L1cPqhwxEZrSkdI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nvag+/Grt32GNnvNxuX1YbG2W91WsQhMmIVNWjPow1IVVtAs5aOX9px0EwsR86vTSba9ZhXwWpHoqUZpSefhnAnMJOoMxYDjuJGCMEGg2t9AQvqt+NLIKP9OvjzLupioTozt8w4xNOgvsgOtggwjvA6kMuT1+MnaGX9EYt0r0Vs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kdH9PSl3; arc=none smtp.client-ip=209.85.214.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kdH9PSl3" Received: by mail-pl1-f196.google.com with SMTP id d9443c01a7336-29568d93e87so46460995ad.2 for ; Mon, 08 Dec 2025 20:16:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765253776; x=1765858576; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FlJMjioQT5hFyjTQfgGib/nn3aRlpyKPcJRzd9y5r+E=; b=kdH9PSl3Fx/laRO35dI5wNoLTc52VczkPkXldwAzix+S18hkFWxkYlCBzNYGWTEecV U8uevCt2RcbVfJvhyyu7BVVO4SIwzVbCtGtzxZPt3wko3R3JAvlAMmFgolQfdzuXLrJn JLAAEwXrlKQufXxLl+1WD2YjY/DJLNR3/l5PiGvfcIJspVU0WSlTiMkjV6dW9d4creqg 3FHQqaUYPuUR7WFyBJf295gD5kZoEUO2S9hNLx39rVo0/pTbSUC0ezasRm/skZ8n7IRr VTyKbgDn6xzq+Es33Jp8sBqAw0/lXlBMmneRVYEVThLX522+rdsT1IIAJpMfgeBZ/JFm gmDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765253776; x=1765858576; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=FlJMjioQT5hFyjTQfgGib/nn3aRlpyKPcJRzd9y5r+E=; b=H58Ah3UFVqPtm1Dan+Uc8IpFOssvUDbMZa6OqsCU98BH0pYt0BwnBnfLCellugsEiV SitAKyNfSfjW9O0XTkzVUFrUzy/q6Q+Hy63H1BKuGFR4tQ9lnB5GywkH8nxtYKiij3nE IYcAJAv132JZpP/CJ5F2Kh1+FzU9GcLOGTL6e6TjGNYd3gIS9zRitEh07bltpomiZwvg U4NNeHCO1YnydlE5Jxoe+UNqi30kkuS/UcfSdSyKNjcnvESn5Es66oVKFxJ+Hi/YGEpq cs4UY6N9EhTnLUi1zMR3LO280MwkTxY5VWD8a/609qFZG2r6b/Ok4Zaq7ewmkRHzUm0Z 9VvA== X-Forwarded-Encrypted: i=1; AJvYcCX6HbKZIQY9+RCoQar2zKwrbr/OtFR5EXdBko4IqHfW9B7mNXokGutrINgeW1nmRy0fxAIfgzkArSP1nRg=@vger.kernel.org X-Gm-Message-State: AOJu0YzpRjhrdKLAMbANglqYbvXfKwr+8FayF19BdJRTZEz15S4j+7eI 3XLyObt+9/Hp8z1JkedyKd8mdZlYeGS5uJU/JNSg6PguoF/vpPAl87C6 X-Gm-Gg: ASbGnctAhQ8Tvrei7EroFmxFjOm0B6QTq5V8LyUYvKq8LSzmuE1d/QGQ+L9/1CMcPJY POmk4zKZZWvwtjcPIezvjHyNUeGMOv0Z0FnIZpNttGmtPUbjZpo/IMB2xozMC00Ezj7Yx+XtF9U lPUMmUokDJHazTWkUScvHwTqVdhlyUqToQK5AsZr3OYBKor6J20wGfwLmq66PbyXwvpg3rVqWXu 9VcYNjQhS1jJ0q33XAKtwTy9O68e6K27S0UAHi4/sHuvQXoXk98ACmJFUx497Ie6jhMlfwi8u2v iYot8QP2SpOsZjmjyf+THNJn+FrL8DnnRyFl7EEPq+Q7FxMCgH/2q0ZTXFZ54qnyQxWJkl6vkUr kzNSeZ2SOVlKDOHtumvKs5Fm3k+4grHQIpD+h4BKq3IZ55BVISIANFNYVNzTP2ACwv2qBZ425lZ uybUJUO90kLFD7YHfp2MQruOPe30Ta+YDf7cPHbrPgFINog04U6Lc= X-Google-Smtp-Source: AGHT+IF+n41cK6qyOclXKfTA9gq7iCinUctpvRZ1cPZYr5mMQx60DHOAwzuQ2syrMzUSlAxPhD3pUA== X-Received: by 2002:a17:903:110e:b0:294:ccc6:cd30 with SMTP id d9443c01a7336-29df5ab1c90mr115886225ad.17.1765253775595; Mon, 08 Dec 2025 20:16:15 -0800 (PST) Received: from nixos (36-231-103-14.dynamic-ip.hinet.net. [36.231.103.14]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-29dae99f01csm137394405ad.48.2025.12.08.20.16.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Dec 2025 20:16:15 -0800 (PST) From: Thaumy Cheng To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Mark Rutland , Alexander Shishkin , Jiri Olsa , Ian Rogers , Adrian Hunter , James Clark Cc: linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, Thaumy Cheng Subject: [PATCH v3 RESEND] perf/core: Fix missing read event generation on task exit Date: Tue, 9 Dec 2025 12:16:00 +0800 Message-ID: <20251209041600.963586-1-thaumy.love@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For events with inherit_stat enabled, a "read" event will be generated to collect per task event counts on task exit. The call chain is as follows: do_exit -> perf_event_exit_task -> perf_event_exit_task_context -> perf_event_exit_event -> perf_remove_from_context -> perf_child_detach -> sync_child_event -> perf_event_read_event However, the child event context detaches the task too early in perf_event_exit_task_context, which causes sync_child_event to never generate the read event in this case, since child_event->ctx->task is always set to TASK_TOMBSTONE. Fix that by moving context lock section backward to ensure ctx->task is not set to TASK_TOMBSTONE before generating the read event. Because perf_event_free_task calls perf_event_exit_task_context with exit =3D false to tear down all child events from the context, and the task never lived, accessing the task PID can lead to a use-after-free. To fix that, let sync_child_event read task from argument and move the call to the only place it should be triggered to avoid the effect of setting ctx->task to TASK_TOMESTONE, and add a task parameter to perf_event_exit_event to trigger the sync_child_event properly when needed. This bug can be reproduced by running "perf record -s" and attaching to any program that generates perf events in its child tasks. If we check the result with "perf report -T", the last line of the report will leave an empty table like "# PID TID", which is expected to contain the per-task event counts by design. Fixes: ef54c1a476ae ("perf: Rework perf_event_exit_event()") Signed-off-by: Thaumy Cheng --- Changes in v3: - Fix the bug in a more direct way by moving the call to sync_child_event and bring back the task param to perf_event_exit_event. This approach avoids the event unscheduling issue in v2. Changes in v2: - Only trigger read event on task exit. - Rename perf_event_exit_event to perf_event_detach_event. - Link to v2: https://lore.kernel.org/all/20250817132742.85154-1-thaumy.lov= e@gmail.com/ Changes in v1: - Set TASK_TOMBSTONE after the read event is tirggered. - Link to v1: https://lore.kernel.org/all/20250720000424.12572-1-thaumy.lov= e@gmail.com/ kernel/events/core.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 177e57c1a362..618e7947c358 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2316,7 +2316,8 @@ static void perf_group_detach(struct perf_event *even= t) perf_event__header_size(leader); } -static void sync_child_event(struct perf_event *child_event); +static void sync_child_event(struct perf_event *child_event, + struct task_struct *task); static void perf_child_detach(struct perf_event *event) { @@ -2336,7 +2337,6 @@ static void perf_child_detach(struct perf_event *even= t) lockdep_assert_held(&parent_event->child_mutex); */ - sync_child_event(event); list_del_init(&event->child_list); } @@ -4587,6 +4587,7 @@ static void perf_event_enable_on_exec(struct perf_eve= nt_context *ctx) static void perf_remove_from_owner(struct perf_event *event); static void perf_event_exit_event(struct perf_event *event, struct perf_event_context *ctx, + struct task_struct *task, bool revoke); /* @@ -4614,7 +4615,7 @@ static void perf_event_remove_on_exec(struct perf_eve= nt_context *ctx) modified =3D true; - perf_event_exit_event(event, ctx, false); + perf_event_exit_event(event, ctx, ctx->task, false); } raw_spin_lock_irqsave(&ctx->lock, flags); @@ -12437,7 +12438,7 @@ static void __pmu_detach_event(struct pmu *pmu, str= uct perf_event *event, /* * De-schedule the event and mark it REVOKED. */ - perf_event_exit_event(event, ctx, true); + perf_event_exit_event(event, ctx, ctx->task, true); /* * All _free_event() bits that rely on event->pmu: @@ -13994,14 +13995,13 @@ void perf_pmu_migrate_context(struct pmu *pmu, in= t src_cpu, int dst_cpu) } EXPORT_SYMBOL_GPL(perf_pmu_migrate_context); -static void sync_child_event(struct perf_event *child_event) +static void sync_child_event(struct perf_event *child_event, + struct task_struct *task) { struct perf_event *parent_event =3D child_event->parent; u64 child_val; if (child_event->attr.inherit_stat) { - struct task_struct *task =3D child_event->ctx->task; - if (task && task !=3D TASK_TOMBSTONE) perf_event_read_event(child_event, task); } @@ -14020,7 +14020,9 @@ static void sync_child_event(struct perf_event *chi= ld_event) static void perf_event_exit_event(struct perf_event *event, - struct perf_event_context *ctx, bool revoke) + struct perf_event_context *ctx, + struct task_struct *task, + bool revoke) { struct perf_event *parent_event =3D event->parent; unsigned long detach_flags =3D DETACH_EXIT; @@ -14043,6 +14045,9 @@ perf_event_exit_event(struct perf_event *event, mutex_lock(&parent_event->child_mutex); /* PERF_ATTACH_ITRACE might be set concurrently */ attach_state =3D READ_ONCE(event->attach_state); + + if (attach_state & PERF_ATTACH_CHILD) + sync_child_event(event, task); } if (revoke) @@ -14134,7 +14139,7 @@ static void perf_event_exit_task_context(struct tas= k_struct *task, bool exit) perf_event_task(task, ctx, 0); list_for_each_entry_safe(child_event, next, &ctx->event_list, event_entry) - perf_event_exit_event(child_event, ctx, false); + perf_event_exit_event(child_event, ctx, exit ? task : NULL, false); mutex_unlock(&ctx->mutex); -- 2.51.0