On 8/16/26 16:57, Steven Rostedt wrote:
On Sun, 16 Aug 2026 15:31:01 +0200 Peter Jung<[email protected]> wrote:This reverts commit be94a3a77e7eb99c53418de7d4a01bc7eb3f634e. The upstream commit was applied after commit 57918341dd19 ("bpf: Add sleepable support for classic tracepoint programs"), which moved BPF program execution before the per-CPU perf event list is checked. The 7.1.y implementation has not undergone that restructuring. It handles BPF and perf consumers together, and already reloads the current CPU's perf event list after syscall_get_data(). As a result, the backport adds an unconditional hlist_empty() return before bpf_prog_array_valid() is consulted. A syscall trace event can have a valid BPF program array while the current CPU's perf event list is empty. In that case the early return prevents the BPF program from running. This breaks BPF consumers of faultable syscall-enter tracepoints such as sys_enter_execve. One observed consequence is that Proton VPN's app-based split tunneling no longer receives exec argument events and therefore cannot match newly started processes. Revert the stable backport. The existing head assignment below the removed block preserves its intended stale-head protection while retaining the previous BPF-aware handling.OK, so the Fixes on the original commit be94a3a77e7e should have had: Fixes: 57918341dd19 ("bpf: Add sleepable support for classic tracepoint programs") Instead? -- Steve
Yes, this should fix it too, but has been not verified yet. I will run a test tomorrow and let you know.
Best, Peter
Fixes: be94a3a77e7e ("tracing: perf: Fix stale head for perf syscall tracing") Cc:[email protected] Assisted-by:Codex:gpt-5.6-sol Signed-off-by: Peter Jung<[email protected]> --- kernel/trace/trace_syscalls.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c index 8dcedff8429a..8ad72e17d8eb 100644 --- a/kernel/trace/trace_syscalls.c +++ b/kernel/trace/trace_syscalls.c @@ -1436,11 +1436,6 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id) if (syscall_get_data(sys_data, args, &user_ptr, &size, user_sizes, &uargs, buf_size) < 0) return; - - /* The above may have caused a migration */ - head = this_cpu_ptr(sys_data->enter_event->perf_events); - if (hlist_empty(head)) - return; }head = this_cpu_ptr(sys_data->enter_event->perf_events);
