Re: [PATCH] perf/bpf: Fix lockless access to parent_event->prog in perf_event_alloc()

commit ba658ac0ee57b66edf6626745df8d57173c68285
Author: Deepanshu Kartikey [off-list ref]
Date:   Fri Aug 21 07:12:10 2026 +0530

    perf/bpf: Fix lockless access to parent_event->prog in perf_event_alloc()

    During fork(), perf_event_alloc() reads parent_event->prog locklessly
    which can race with a concurrent bpf_perf_link_release() clearing and
    freeing the prog via perf_event_detach_bpf_prog(). This can result in
    a NULL pointer dereference or use-after-free in bpf_prog_inc().

    Fix by holding bpf_event_mutex when inheriting the BPF program during
    fork(). Make bpf_event_mutex non-static and declare it extern in
    perf_event.h so it is accessible from kernel/events/core.c.

    Fixes: 85192dbf4de0 ("bpf: Convert bpf_prog refcnt to atomic64_t")

The Fixes tag points at commit 85192dbf4de0 ("bpf: Convert bpf_prog
refcnt to atomic64_t") by Andrii Nakryiko, which only converted
bpf_prog->aux->refcnt from atomic_t to atomic64_t and made bpf_prog_inc()
non-failing.

That commit's modified-symbol set is entirely in kernel/bpf/,
include/linux/bpf.h and various net drivers, and it does not touch
kernel/events/core.c or perf_event_alloc() at all.

The unlocked read of parent_event->prog in perf_event_alloc() predates
it and was introduced by the commit that added BPF overflow-handler
inheritance to perf_event_alloc().

Should the Fixes tag name the commit that introduced the unlocked read so
the fix is backported to the right stable trees?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32437947108