perf: Fix hotplug splat

commit e3703f8cdfcf39c25c4338c3ad8e68891cca3731 upstream.

Drew Richardson reported that he could make the kernel go *boom* when hotplugging
while having perf events active.

It turned out that when you have a group event, the code in
__perf_event_exit_context() fails to remove the group siblings from
the context.

We then proceed with destroying and freeing the event, and when you
re-plug the CPU and try and add another event to that CPU, things go
*boom* because you've still got dead entries there.

Reported-by: Drew Richardson <drew.richardson@arm.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will.deacon@arm.com>
Link: http://lkml.kernel.org/n/tip-k6v5wundvusvcseqj1si0oz0@git.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 83d5621..b15b4f7 100644 (file)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7101,14 +7101,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu)
 static void __perf_event_exit_context(void *__info)
 {
        struct perf_event_context *ctx = __info;
 static void __perf_event_exit_context(void *__info)
 {
        struct perf_event_context *ctx = __info;

-       struct perf_event *event, *tmp;
+       struct perf_event *event;

 
        perf_pmu_rotate_stop(ctx->pmu);
 
 
        perf_pmu_rotate_stop(ctx->pmu);
 

-       list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry)
-               __perf_remove_from_context(event);
-       list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry)
+       rcu_read_lock();
+       list_for_each_entry_rcu(event, &ctx->event_list, event_entry)

                __perf_remove_from_context(event);
                __perf_remove_from_context(event);

+       rcu_read_unlock();

 }
 
 static void perf_event_exit_cpu_context(int cpu)
 }
 
 static void perf_event_exit_cpu_context(int cpu)


@@ -7132,11 +7132,11 @@ static void perf_event_exit_cpu(int cpu)
 {
        struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 
 {
        struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
 

+       perf_event_exit_cpu_context(cpu);
+

        mutex_lock(&swhash->hlist_mutex);
        swevent_hlist_release(swhash);
        mutex_unlock(&swhash->hlist_mutex);
        mutex_lock(&swhash->hlist_mutex);
        swevent_hlist_release(swhash);
        mutex_unlock(&swhash->hlist_mutex);

-
-       perf_event_exit_cpu_context(cpu);

 }
 #else
 static inline void perf_event_exit_cpu(int cpu) { }
 }
 #else
 static inline void perf_event_exit_cpu(int cpu) { }