diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-25 17:52:28 -1000 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-25 17:52:28 -1000 |
| commit | dc7be96c1cac85cc172b90a47f80e23d847c9203 (patch) | |
| tree | f2101e71dcfb5d96ff524f6a88d91f685f5f3a33 /kernel | |
| parent | 2b19759b46aee85627b58f3722846424201f24a7 (diff) | |
| parent | d095321349222961813333277881b3c74f10b17b (diff) | |
Merge tag 'perf-urgent-2026-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix Alpha build failure caused by a semantic conflict
between perf and arch-alpha changes (Thomas Weißschuh)
- Fix UAF in attach_task_ctx_data() (Lee Jia Jie)
- Fix perf_remove_from_context() event scheduling (Peter Zijlstra)
* tag 'perf-urgent-2026-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Fix perf_remove_from_context() event scheduling
perf: Fix UAF in attach_task_ctx_data()
alpha: add simd_enabled argument to perf_reg_validate()
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/events/core.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/kernel/events/core.c b/kernel/events/core.c index a9ee91151b2d..f36a3bbaa33c 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2590,6 +2590,7 @@ __perf_remove_from_context(struct perf_event *event, enum perf_event_state state = PERF_EVENT_STATE_OFF; unsigned long flags = (unsigned long)info; + perf_pmu_disable(pmu_ctx->pmu); ctx_time_update(cpuctx, ctx); /* @@ -2603,6 +2604,13 @@ __perf_remove_from_context(struct perf_event *event, if (flags & DETACH_DEAD) state = PERF_EVENT_STATE_DEAD; + /* + * When disabling a group leader, the whole group becomes ineligible + * to run, so schedule out the full group. + */ + if (!(flags & DETACH_GROUP) && event == event->group_leader) + group_sched_out(event, ctx); + __event_disable(event, ctx, state); if (flags & DETACH_GROUP) @@ -2632,6 +2640,7 @@ __perf_remove_from_context(struct perf_event *event, cpuctx->task_ctx = NULL; } } + perf_pmu_enable(pmu_ctx->pmu); } /* @@ -5434,6 +5443,9 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache, return -ENOMEM; for (;;) { + /* Protect @old until inc_not_zero(&old->refcount) */ + guard(rcu)(); + if (try_cmpxchg(&task->perf_ctx_data, &old, cd)) { if (old) perf_free_ctx_data_rcu(old); |