[tip: perf/urgent] perf: Fix race between perf_event_exit_task() and perf_pending_task()

[tip-bot2 for Luo Gengkun]

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     ffb684f2aa141eeb0caa6308422e7e05d1ded7c4
Gitweb:        https://git.kernel.org/tip/ffb684f2aa141eeb0caa6308422e7e05d1ded7c4
Author:        Luo Gengkun <luogengkun2@xxxxxxxxxx>
AuthorDate:    Sun, 20 Sep 2026 07:50:26 
Committer:     Peter Zijlstra <peterz@xxxxxxxxxxxxx>
CommitterDate: Thu, 01 Oct 2026 14:02:05 +02:00

perf: Fix race between perf_event_exit_task() and perf_pending_task()

A race condition exists between perf_event_exit_task() and
perf_pending_task() during begin_new_exec().

During begin_new_exec(), perf_event_exit_task() may be called, and the
PF_EXITING flag is not set on task. So perf_sigtrap() continues to execute
and triggers WARN_ON_ONCE(event->ctx->task != current).

Since both task exit and exec paths can call perf_event_exit_task() which
sets ctx->task to TASK_TOMBSTONE, fix this by explicitly checking if
event->ctx->task equals TASK_TOMBSTONE and dropping the redundant
PF_EXITING check.

Fixes: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
Signed-off-by: Luo Gengkun <luogengkun2@xxxxxxxxxx>
Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
Link: https://patch.msgid.link/20260920075026.990582-1-luogengkun2@xxxxxxxxxx
---
 kernel/events/core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 634d2cc..c2882b5 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7626,9 +7626,11 @@ static void perf_sigtrap(struct perf_event *event)
 {
 	/*
 	 * Both perf_pending_task() and perf_pending_irq() can race with the
-	 * task exiting.
+	 * task exiting or exec-ing. We can determine if such a race has
+	 * occurred by checking if perf_event_exit_task(), which will set
+	 * ctx->task to TASK_TOMBSTONE, has already been called.
 	 */
-	if (current->flags & PF_EXITING)
+	if (event->ctx->task == TASK_TOMBSTONE)
 		return;
 
 	/*