This reverts commit be94a3a77e7eb99c53418de7d4a01bc7eb3f634e.

The upstream commit was applied after commit 57918341dd19 ("bpf: Add
sleepable support for classic tracepoint programs"), which moved BPF
program execution before the per-CPU perf event list is checked.

The 7.1.y implementation has not undergone that restructuring. It handles
BPF and perf consumers together, and already reloads the current CPU's
perf event list after syscall_get_data().

As a result, the backport adds an unconditional hlist_empty() return before
bpf_prog_array_valid() is consulted. A syscall trace event can have a valid
BPF program array while the current CPU's perf event list is empty. In that
case the early return prevents the BPF program from running.

This breaks BPF consumers of faultable syscall-enter tracepoints such as
sys_enter_execve. One observed consequence is that Proton VPN's app-based
split tunneling no longer receives exec argument events and therefore
cannot match newly started processes.

Revert the stable backport. The existing head assignment below the removed
block preserves its intended stale-head protection while retaining the
previous BPF-aware handling.

Fixes: be94a3a77e7e ("tracing: perf: Fix stale head for perf syscall tracing")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Peter Jung <admin@ptr1337.dev>
---
 kernel/trace/trace_syscalls.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 8dcedff8429a..8ad72e17d8eb 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -1436,11 +1436,6 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
 		if (syscall_get_data(sys_data, args, &user_ptr,
 				     &size, user_sizes, &uargs, buf_size) < 0)
 			return;
-
-		/* The above may have caused a migration */
-		head = this_cpu_ptr(sys_data->enter_event->perf_events);
-		if (hlist_empty(head))
-			return;
 	}
 
 	head = this_cpu_ptr(sys_data->enter_event->perf_events);
-- 
2.51.0

> The 7.1.y implementation has not undergone that restructuring. It handles
> BPF and perf consumers together, and already reloads the current CPU's
> perf event list after syscall_get_data().

The analysis checks out on 7.1.y: 57918341dd19 ("bpf: Add sleepable
support for classic tracepoint programs") is not there, so the added
hlist_empty() early return runs before bpf_prog_array_valid() is ever
consulted and a BPF-only consumer stops firing.

Since this reverts a commit that already shipped in 7.1.6, I would like
your test result before queueing it - you mentioned you would have one
today. Ping the thread once you do and I will pick it up.

-- 
Thanks,
Sasha

On Sun, 16 Aug 2026 15:31:01 +0200
Peter Jung <admin@ptr1337.dev> wrote:

> This reverts commit be94a3a77e7eb99c53418de7d4a01bc7eb3f634e.
> 
> The upstream commit was applied after commit 57918341dd19 ("bpf: Add
> sleepable support for classic tracepoint programs"), which moved BPF
> program execution before the per-CPU perf event list is checked.
> 
> The 7.1.y implementation has not undergone that restructuring. It handles
> BPF and perf consumers together, and already reloads the current CPU's
> perf event list after syscall_get_data().
> 
> As a result, the backport adds an unconditional hlist_empty() return before
> bpf_prog_array_valid() is consulted. A syscall trace event can have a valid
> BPF program array while the current CPU's perf event list is empty. In that
> case the early return prevents the BPF program from running.
> 
> This breaks BPF consumers of faultable syscall-enter tracepoints such as
> sys_enter_execve. One observed consequence is that Proton VPN's app-based
> split tunneling no longer receives exec argument events and therefore
> cannot match newly started processes.
> 
> Revert the stable backport. The existing head assignment below the removed
> block preserves its intended stale-head protection while retaining the
> previous BPF-aware handling.


OK, so the Fixes on the original commit be94a3a77e7e should have had:

Fixes: 57918341dd19 ("bpf: Add sleepable support for classic tracepoint programs")

Instead?

-- Steve


> 
> Fixes: be94a3a77e7e ("tracing: perf: Fix stale head for perf syscall tracing")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Peter Jung <admin@ptr1337.dev>
> ---
>  kernel/trace/trace_syscalls.c | 5 -----
>  1 file changed, 5 deletions(-)
> 
> diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
> index 8dcedff8429a..8ad72e17d8eb 100644
> --- a/kernel/trace/trace_syscalls.c
> +++ b/kernel/trace/trace_syscalls.c
> @@ -1436,11 +1436,6 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
>  		if (syscall_get_data(sys_data, args, &user_ptr,
>  				     &size, user_sizes, &uargs, buf_size) < 0)
>  			return;
> -
> -		/* The above may have caused a migration */
> -		head = this_cpu_ptr(sys_data->enter_event->perf_events);
> -		if (hlist_empty(head))
> -			return;
>  	}
>  
>  	head = this_cpu_ptr(sys_data->enter_event->perf_events);

On 8/16/26 16:57, Steven Rostedt wrote:
> On Sun, 16 Aug 2026 15:31:01 +0200
> Peter Jung<admin@ptr1337.dev> wrote:
> 
>> This reverts commit be94a3a77e7eb99c53418de7d4a01bc7eb3f634e.
>>
>> The upstream commit was applied after commit 57918341dd19 ("bpf: Add
>> sleepable support for classic tracepoint programs"), which moved BPF
>> program execution before the per-CPU perf event list is checked.
>>
>> The 7.1.y implementation has not undergone that restructuring. It handles
>> BPF and perf consumers together, and already reloads the current CPU's
>> perf event list after syscall_get_data().
>>
>> As a result, the backport adds an unconditional hlist_empty() return before
>> bpf_prog_array_valid() is consulted. A syscall trace event can have a valid
>> BPF program array while the current CPU's perf event list is empty. In that
>> case the early return prevents the BPF program from running.
>>
>> This breaks BPF consumers of faultable syscall-enter tracepoints such as
>> sys_enter_execve. One observed consequence is that Proton VPN's app-based
>> split tunneling no longer receives exec argument events and therefore
>> cannot match newly started processes.
>>
>> Revert the stable backport. The existing head assignment below the removed
>> block preserves its intended stale-head protection while retaining the
>> previous BPF-aware handling.
> 
> OK, so the Fixes on the original commit be94a3a77e7e should have had:
> 
> Fixes: 57918341dd19 ("bpf: Add sleepable support for classic tracepoint programs")
> 
> Instead?
> 
> -- Steve
> 

Yes, this should fix it too, but has been not verified yet. I will run a 
test tomorrow and let you know.

Best,

Peter

> 
>> Fixes: be94a3a77e7e ("tracing: perf: Fix stale head for perf syscall tracing")
>> Cc:stable@vger.kernel.org
>> Assisted-by:Codex:gpt-5.6-sol
>> Signed-off-by: Peter Jung<admin@ptr1337.dev>
>> ---
>>   kernel/trace/trace_syscalls.c | 5 -----
>>   1 file changed, 5 deletions(-)
>>
>> diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
>> index 8dcedff8429a..8ad72e17d8eb 100644
>> --- a/kernel/trace/trace_syscalls.c
>> +++ b/kernel/trace/trace_syscalls.c
>> @@ -1436,11 +1436,6 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
>>   		if (syscall_get_data(sys_data, args, &user_ptr,
>>   				     &size, user_sizes, &uargs, buf_size) < 0)
>>   			return;
>> -
>> -		/* The above may have caused a migration */
>> -		head = this_cpu_ptr(sys_data->enter_event->perf_events);
>> -		if (hlist_empty(head))
>> -			return;
>>   	}
>>   
>>   	head = this_cpu_ptr(sys_data->enter_event->perf_events);
>