Hi,

Could you share the config with me so that I can reproduce the issue on my setup?

I have tested with x86_64 default config without error, seems there is something different with my local setup.

Thanks.

Br,

Xiangyu

On 4/10/25 23:53, Sasha Levin wrote:

CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.

[ Sasha's backport helper bot ]

Hi,

Summary of potential issues: ❌ Build failures detected ⚠️ Found follow-up fixes in mainline

The upstream commit SHA1 provided is correct: 517e6a301f34613bff24a8e35b5455884f2d83d8

WARNING: Author mismatch between patch and upstream commit: Backport author: Xiangyu Chenxiangyu.chen@eng.windriver.com Commit author: Peter Zijlstrapeterz@infradead.org

Status in newer kernel trees: 6.14.y | Present (exact SHA1) 6.13.y | Present (exact SHA1) 6.12.y | Present (exact SHA1) 6.6.y | Present (exact SHA1) 6.1.y | Present (exact SHA1) 5.15.y | Present (different SHA1: 8bffa95ac19f)

Found fixes commits: 3a5465418f5f perf: Fix event leak upon exec and file release 2fd5ad3f310d perf: Fix event leak upon exit

Note: The patch differs from the upstream commit:

1: 517e6a301f346 ! 1: b2173ec15f3b2 perf: Fix perf_pending_task() UaF @@ Metadata ## Commit message ## perf: Fix perf_pending_task() UaF

 +    [ Upstream commit 517e6a301f34613bff24a8e35b5455884f2d83d8 ]
 +
      Per syzbot it is possible for perf_pending_task() to run after the
      event is free()'d. There are two related but distinct cases:

 @@ Commit message
      Reported-by: syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com
      Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
      Tested-by: Marco Elver <elver@google.com>
 +    [ Discard the changes in event_sched_out() due to 5.10 don't have the
 +    commit: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events")
 +    and commit: ca6c21327c6a ("perf: Fix missing SIGTRAPs") ]
 +    Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
 +    Signed-off-by: He Zhe <zhe.he@windriver.com>

   ## kernel/events/core.c ##
 -@@ kernel/events/core.c: event_sched_out(struct perf_event *event,
 -               !event->pending_work) {
 -                   event->pending_work = 1;
 -                   dec = false;
 -+                  WARN_ON_ONCE(!atomic_long_inc_not_zero(&event->refcount));
 -                   task_work_add(current, &event->pending_task, TWA_RESUME);
 -           }
 -           if (dec)
  @@ kernel/events/core.c: group_sched_out(struct perf_event *group_event,
 + }

   #define DETACH_GROUP      0x01UL
 - #define DETACH_CHILD      0x02UL
  +#define DETACH_DEAD       0x04UL

   /*
 @@ kernel/events/core.c: __perf_remove_from_context(struct perf_event *event,
     event_sched_out(event, cpuctx, ctx);
     if (flags & DETACH_GROUP)
             perf_group_detach(event);
 -   if (flags & DETACH_CHILD)
 -           perf_child_detach(event);
     list_del_event(event, ctx);
  +  if (flags & DETACH_DEAD)
  +          event->state = PERF_EVENT_STATE_DEAD;
 @@ kernel/events/core.c: int perf_event_release_kernel(struct perf_event *event)

     perf_event_ctx_unlock(event, ctx);

 -@@ kernel/events/core.c: static void perf_pending_task(struct callback_head *head)
 +@@ kernel/events/core.c: static void perf_pending_event(struct irq_work *entry)
 +
     if (rctx >= 0)
             perf_swevent_put_recursion_context(rctx);
 -   preempt_enable_notrace();
  +
  +  put_event(event);
   }

 - #ifdef CONFIG_GUEST_PERF_EVENTS
 + /*

---

Results of testing on various branches:

| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Failed |

Build Errors: Build error for stable/linux-5.10.y: kernel/trace/trace_events_synth.c: In function 'synth_event_reg': kernel/trace/trace_events_synth.c:769:9: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement] 769 | int ret = trace_event_reg(call, type, data); | ^~~ In file included from ./include/linux/kernel.h:15, from ./include/linux/list.h:9, from ./include/linux/kobject.h:19, from ./include/linux/of.h:17, from ./include/linux/clk-provider.h:9, from drivers/clk/qcom/clk-rpmh.c:6: drivers/clk/qcom/clk-rpmh.c: In function 'clk_rpmh_bcm_send_cmd': ./include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types] 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ ./include/linux/minmax.h:26:18: note: in expansion of macro '__typecheck' 26 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ ./include/linux/minmax.h:36:31: note: in expansion of macro '__safe_cmp' 36 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ ./include/linux/minmax.h:45:25: note: in expansion of macro '__careful_cmp' 45 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ drivers/clk/qcom/clk-rpmh.c:273:21: note: in expansion of macro 'min' 273 | cmd_state = min(cmd_state, BCM_TCS_CMD_VOTE_MASK); | ^~~ drivers/firmware/efi/mokvar-table.c: In function 'efi_mokvar_table_init': drivers/firmware/efi/mokvar-table.c:107:23: warning: unused variable 'size' [-Wunused-variable] 107 | unsigned long size; | ^~~~ .tmp_vmlinux.kallsyms2.S:196892:57: internal compiler error: Segmentation fault 196892 | .byte 0x0b, 0x74, 0x77, 0x77, 0x5f, 0xb6, 0x73, 0xfc, 0x6e, 0xbd, 0x6d, 0xed | ^~~~ 0x7f74e8f6cd1f ??? ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 0x7f74e8f56d67 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 0x7f74e8f56e24 __libc_start_main_impl ../csu/libc-start.c:360 Please submit a full bug report, with preprocessed source (by using -freport-bug). Please include the complete backtrace with any bug report. See https://gcc.gnu.org/bugs/ for instructions. make: *** [Makefile:1212: vmlinux] Error 1 make: Target '__all' not remade because of errors.