[PATCH 2/2] perf/core: Cancel PMU mux hrtimer before freeing per-CPU context
flat view
HOTtoday
From: Dapeng Mi <hidden>
Date: 2026-11-02 01:06:51
Also in:
lkml
Subsystem:
performance events subsystem, the rest · Maintainers:
Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Linus Torvalds
perf_pmu_free() can free the PMU's per-CPU perf_cpu_pmu_context while the multiplexing hrtimer is still armed. Once the timer expires, it dereferences the freed cpc and can crash the kernel. Cancel the multiplexing hrtimer before freeing the PMU context by adding a perf_mux_cancel_hrtimer() helper and invoking it from the PMU free path. Reported-by: Hanxiang Xu <redacted> Closes: https://lore.kernel.org/all/ca4f133.14714.1a162b8654c.Coremail.xuhx@hust.edu.cn/ (local) Fixes: 8f4c4963d283 ("perf/core: Simplify the perf_pmu_register() error path") Signed-off-by: Dapeng Mi <redacted> --- kernel/events/core.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index e088c31534bc..54eb962ab6ff 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c@@ -1316,6 +1316,12 @@ static void __perf_mux_hrtimer_init(struct perf_cpu_pmu_context *cpc, int cpu) HRTIMER_MODE_ABS_PINNED_HARD); } +static void perf_mux_cancel_hrtimer(struct perf_cpu_pmu_context *cpc) +{ + cpc->hrtimer_active = 0; + hrtimer_cancel(&cpc->hrtimer); +} + static int perf_mux_hrtimer_restart(struct perf_cpu_pmu_context *cpc) { struct hrtimer *timer = &cpc->hrtimer;
@@ -13024,6 +13030,7 @@ static void perf_pmu_free(struct pmu *pmu) cpc = *per_cpu_ptr(pmu->cpu_pmu_context, cpu); if (!cpc) continue; + perf_mux_cancel_hrtimer(cpc); if (cpc->epc.embedded) { /* refcount managed */ put_pmu_ctx(&cpc->epc);
--
2.34.1