Re: [PATCH 19/19] perf: Make perf_pmu_unregister() useable

[Peter Zijlstra]

On Fri, Jan 17, 2025 at 10:50:26AM +0530, Ravi Bangoria wrote:
> Hi Peter,
> 
> >> 4) A race with perf_event_set_bpf_prog(). perf_event_set_bpf_prog() might
> >>    be in process of setting event->prog, where as perf_pmu_unregister(),
> >>    which internally calls perf_event_free_bpf_prog(), will clear the
> >>    event->prog pointer.
> >>
> >>    perf_pmu_unregister()                perf_event_set_bpf_prog()
> >>      ...                                  perf_event_set_bpf_handler()
> >>        perf_event_free_bpf_prog()           event->prog = prog;
> >>          event->prog = NULL;
> >>
> >> I've yet to inspect other code paths, so there might be more races.
> > 
> > Weird, that should be serialized by perf_event_ctx_lock(), both
> > __pmu_detach_event() and _perf_ioctl() are called under that.
> 
> There are multiple code paths leading to perf_event_set_bpf_prog(). The
> one starting from _perf_ioctl() is serialized. However, this is not:
> 
>   __sys_bpf()
>     link_create()
>       bpf_perf_link_attach()
>         perf_event_set_bpf_prog()
>           perf_event_set_bpf_handler()
>             event->prog = prog;
> 

Urgh yeah, that's broken. Damn bpf stuff :-/