Public bug reported:
Since 7.0.0-38.38, BPF programs attached to faultable syscall-enter
tracepoints (sys_enter_execve, sys_enter_openat, ...) only run on the
CPU where the perf event was opened (CPU 0 for bpftrace, cilium/ebpf,
libbpf). Events from other CPUs are silently dropped, which breaks eBPF
tools such as Inspektor Gadget and bpftrace.
The cause is the stable backport "tracing: perf: Fix stale head for perf
syscall tracing" (upstream 2c2b322acdcc, 7.1.y be94a3a77e7e), which came
in with the upstream stable patchset of 2026-08-26 (LP: #2165189).
Upstream, it relies on 57918341dd19 ("bpf: Add sleepable support for
classic tracepoint programs"), which runs BPF before the per-CPU perf
list check; that commit is not in 7.0. Without it, the new `if
(hlist_empty(head)) return;` returns before `bpf_prog_array_valid()` is
consulted. The same issue exists in 7.1.y, where a revert is pending:
https://lore.kernel.org/all/[email protected]/
Reproducer (8 CPUs, arm64, 7.0.0-38-generic):
```
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat /comm == "cat"/ { @[cpu]
= count(); }' &
for c in $(seq 0 $(($(nproc)-1))); do taskset -c $c cat /etc/hostname
>/dev/null; done
```
Only `@[0]` is reported. sys_exit_openat, raw_syscalls:sys_enter, and
sys_enter_close (no user-pointer args) fire on all CPUs, and so does
plain ftrace on sys_enter_openat.
Fix: revert the backport, as proposed for 7.1.y.
---
ProblemType: Bug
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: arm64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/seq: ubuntu 3349 F.... pipewire
CasperMD5CheckMismatches: ./boot/grub/grub.cfg
CasperMD5CheckResult: fail
CurrentDesktop: ubuntu:GNOME
DistroRelease: Ubuntu 26.04
InstallationDate: Installed on 2026-09-01 (37 days ago)
InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release arm64
(20260826)
Lsusb:
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 80ee:0010 VirtualBox USB Keyboard
Bus 001 Device 003: ID 80ee:0021 VirtualBox USB Tablet
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Lsusb-t:
/: Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/8p, 480M
|__ Port 001: Dev 002, If 0, Class=Human Interface Device, Driver=usbhid,
12M
|__ Port 002: Dev 003, If 0, Class=Human Interface Device, Driver=usbhid,
12M
/: Bus 002.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/6p, 5000M
Package: linux-azure (not installed)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
ProcFB: 0 vmwgfxdrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=ddf8c059-6ef3-4dc6-9451-2ad28186827f ro
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
RfKill:
Tags: resolute
Uname: Linux 7.0.0-38-generic aarch64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: N/A
_MarkForUpload: True
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux-azure (Ubuntu)
Importance: Undecided
Status: New
** Tags: apport-collected regression-updates resolute
** Tags added: regression-updates
** Also affects: linux-azure (Ubuntu)
Importance: Undecided
Status: New
** Tags added: apport-collected resolute
** Description changed:
Since 7.0.0-38.38, BPF programs attached to faultable syscall-enter
tracepoints (sys_enter_execve, sys_enter_openat, ...) only run on the
CPU where the perf event was opened (CPU 0 for bpftrace, cilium/ebpf,
libbpf). Events from other CPUs are silently dropped, which breaks eBPF
tools such as Inspektor Gadget and bpftrace.
The cause is the stable backport "tracing: perf: Fix stale head for perf
syscall tracing" (upstream 2c2b322acdcc, 7.1.y be94a3a77e7e), which came
in with the upstream stable patchset of 2026-08-26 (LP: #2165189).
Upstream, it relies on 57918341dd19 ("bpf: Add sleepable support for
classic tracepoint programs"), which runs BPF before the per-CPU perf
list check; that commit is not in 7.0. Without it, the new `if
(hlist_empty(head)) return;` returns before `bpf_prog_array_valid()` is
consulted. The same issue exists in 7.1.y, where a revert is pending:
https://lore.kernel.org/all/[email protected]/
Reproducer (8 CPUs, arm64, 7.0.0-38-generic):
```
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat /comm == "cat"/ {
@[cpu] = count(); }' &
for c in $(seq 0 $(($(nproc)-1))); do taskset -c $c cat /etc/hostname
>/dev/null; done
```
Only `@[0]` is reported. sys_exit_openat, raw_syscalls:sys_enter, and
sys_enter_close (no user-pointer args) fire on all CPUs, and so does
plain ftrace on sys_enter_openat.
Fix: revert the backport, as proposed for 7.1.y.
+ ---
+ ProblemType: Bug
+ ApportVersion: 2.34.1-0ubuntu0.1
+ Architecture: arm64
+ AudioDevicesInUse:
+ USER PID ACCESS COMMAND
+ /dev/snd/seq: ubuntu 3349 F.... pipewire
+ CasperMD5CheckMismatches: ./boot/grub/grub.cfg
+ CasperMD5CheckResult: fail
+ CurrentDesktop: ubuntu:GNOME
+ DistroRelease: Ubuntu 26.04
+ InstallationDate: Installed on 2026-09-01 (37 days ago)
+ InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release arm64
(20260826)
+ Lsusb:
+ Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
+ Bus 001 Device 002: ID 80ee:0010 VirtualBox USB Keyboard
+ Bus 001 Device 003: ID 80ee:0021 VirtualBox USB Tablet
+ Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
+ Lsusb-t:
+ /: Bus 001.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/8p, 480M
+ |__ Port 001: Dev 002, If 0, Class=Human Interface Device,
Driver=usbhid, 12M
+ |__ Port 002: Dev 003, If 0, Class=Human Interface Device,
Driver=usbhid, 12M
+ /: Bus 002.Port 001: Dev 001, Class=root_hub, Driver=xhci_hcd/6p, 5000M
+ Package: linux-azure (not installed)
+ ProcEnviron:
+ LANG=en_US.UTF-8
+ PATH=(custom, no user)
+ SHELL=/bin/bash
+ TERM=xterm-256color
+ ProcFB: 0 vmwgfxdrmfb
+ ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=ddf8c059-6ef3-4dc6-9451-2ad28186827f ro
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
+ ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
+ RfKill:
+
+ Tags: resolute
+ Uname: Linux 7.0.0-38-generic aarch64
+ UpgradeStatus: No upgrade log present (probably fresh install)
+ UserGroups: N/A
+ _MarkForUpload: True
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170225
Title:
linux 7.0.0-38: BPF programs on syscalls:sys_enter_* tracepoints with
user-pointer args only run on one CPU
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2170225/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
