perf/bpf: Fix data race in __perf_event_overflow

[kernel-patches-daemon-bpf]

Pull request for series with
subject: perf/bpf: Fix data race in __perf_event_overflow
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381

[kernel-patches-daemon-bpf]

Upstream branch: 07cb86a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-review-bot]

commit ffa161d3558e4937793a0c3e98e19e4b22e58bd9
Author: Deepanshu Kartikey <kartikey406@gmail.com>

perf/bpf: Fix data race in __perf_event_overflow

This commit fixes a data race where perf_event_detach_bpf_prog() writes
event->prog = NULL under bpf_event_mutex, while __perf_event_overflow()
reads event->prog concurrently without lock protection.

Link: https://syzkaller.appspot.com/bug?extid=651d2774bd1d8395595f

> commit ffa161d3558e4937793a0c3e98e19e4b22e58bd9
> Author: Deepanshu Kartikey <kartikey406@gmail.com>
> Date:   Wed Aug 12 05:23:31 2026 +0530
>
>     perf/bpf: Fix data race in __perf_event_overflow
>
>     perf_event_detach_bpf_prog() writes event->prog = NULL
>     under bpf_event_mutex, while __perf_event_overflow() reads
>     event->prog concurrently without any lock protection. This
>     causes a data race detected by KCSAN.
>
>     __perf_event_overflow() can be called from interrupt/NMI
>     context, so it cannot acquire bpf_event_mutex. Fix the race
>     by using WRITE_ONCE() in perf_event_detach_bpf_prog() and
>     READ_ONCE() in __perf_event_overflow(). Also store the result
>     of READ_ONCE() in a local variable to avoid reading event->prog
>     twice which could result in a NULL pointer dereference if the
>     pointer becomes NULL between the two reads.
>
>     Reported-by: syzbot+651d2774bd1d8395595f@syzkaller.appspotmail.com
>     Closes: https://syzkaller.appspot.com/bug?extid=651d2774bd1d8395595f
>     Fixes: f11f10bfa1ca ("perf/bpf: Call BPF handler directly, not through overflow machinery")
>     Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
>     Reported-by: syzbot+651d2774bd1d8395595f@syzkaller.appspotmail.com
>     Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>

The trailer block contains duplicate tags: both Reported-by: and
Signed-off-by: appear twice. Also, the second Reported-by: is placed
after the first Signed-off-by:, which breaks the conventional trailer
ordering (Reported-by/Closes/Fixes should come before Signed-off-by).

Should the duplicates be collapsed to one of each, in proper trailer order?

---

AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

In-Reply-To-Subject: perf/bpf: Fix data race in __perf_event_overflow
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31550171807

[kernel-patches-daemon-bpf]

Forwarding comment 5260785640 via email
In-Reply-To: 20260811235331.10044-1-kartikey406@gmail.com
Patch: https://patchwork.kernel.org/project/netdevbpf/patch/20260811235331.10044-1-kartikey406@gmail.com/

[kernel-patches-daemon-bpf]

Upstream branch: 07cb86a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 611a9f0
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 3a59f11
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 3a59f11
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 108d440
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: a88dbe1
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 7c3e54c
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 6f03361
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 9786d42
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 806c1a1
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: aacd13e
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

Upstream branch: 259d60f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381
version: 1

[kernel-patches-daemon-bpf]

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=1144381 expired. Closing PR.