From nobody Tue Apr 7 04:21:11 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FD82371CFF; Mon, 16 Mar 2026 09:50:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773654633; cv=none; b=IcopR3riUfl7G9AnAAS52SNnLrqYoNjGM0VxWY4HkZfkJilSgUeaJpJLP5L0rG/KwJdIUgwu4aXATtkBgJ+EGpXVqbpzzO2D4ek5AZC5jBejS4J/DG22zi9o0DcCho72dQV5tyIx0VHPTIIVfVpySgqXlINwdglvei3aKRjKxIA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773654633; c=relaxed/simple; bh=Wvy+j76RR32qbHhdi2TKWejO6VnfjIWSBLbG1Ws6WkE=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=PLdW7rQxIzUXWiKbI6D2Ttx5TyFbrDZlHJDhXKb/q1sKLb7W/atGNawwylh4Ng1o/7K0bkJJEgBZJRWnrPdPC4uJSpOf1Y8LLNvoa7sSmlpLw1dq59D2HqoeePpO9Dt80UDk+TCdpSm3r1uFcDIzdSLw144YKxSx29qjvH6jCYA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=f2YbhpMb; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=SbRoyiER; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="f2YbhpMb"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="SbRoyiER" Date: Mon, 16 Mar 2026 09:50:29 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1773654631; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RTJr4nbv77/sWo5nYOm9liaJSZY92SVjTrS+gZbr/jI=; b=f2YbhpMbNAEt1KHpAVRpsO0DsttwsHDWf6VfCqKQWAcYXLr0ggxFIHX/RoBN2//wuKr78m 2ewYMoCpIup9SzfSnOG788HP7hdDGQ/ZgvyeehogKR2N2yGGy79Y8+cnfMDGgym+zX/9dZ C8QUEAnjgoUGSMTx9fEVj2aaloAdKxRgHRK2gJlqebjrlW6zEPWa8al9y8lHig8loiOV2X PcOc3uLKx57mIsCWLkByiCrOes/jB6LZKF2Qddn1RCWVqvP+ahp5odOr9MZPMCZ6p/SJxm mSApTYRxUMFL75mBNBxE/3lhjv7DxGMZtMPMW/1e83BunS0laGGwQofH+ozt1A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1773654631; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RTJr4nbv77/sWo5nYOm9liaJSZY92SVjTrS+gZbr/jI=; b=SbRoyiERa46V628c70PN0FzTW0Fu6Y24DTv91eMyWsZwmuIG1HePiHxgNL3yBxUzamV6Ib XRRkne8+uPxU4QAQ== From: "tip-bot2 for Peter Zijlstra" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: perf/urgent] perf: Make sure to use pmu_ctx->pmu for groups Cc: Oliver Rosenberg , "Peter Zijlstra (Intel)" , Ian Rogers , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260309133713.GB606826@noisy.programming.kicks-ass.net> References: <20260309133713.GB606826@noisy.programming.kicks-ass.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <177365462967.1647592.18022799522631966862.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the perf/urgent branch of tip: Commit-ID: 4b9ce671960627b2505b3f64742544ae9801df97 Gitweb: https://git.kernel.org/tip/4b9ce671960627b2505b3f64742544ae9= 801df97 Author: Peter Zijlstra AuthorDate: Mon, 09 Mar 2026 13:55:46 +01:00 Committer: Peter Zijlstra CommitterDate: Thu, 12 Mar 2026 11:29:16 +01:00 perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory ac= cess when group_sched_in() fails and needs to roll back. This *should* be handled by the transaction callbacks, but he found that wh= en the group leader is a software event, the transaction handlers of the wrong= PMU are used. Despite the move_group case in perf_event_open() and group_sched_= in() using pmu_ctx->pmu. Turns out, inherit uses event->pmu to clone the events, effectively undoing= the move_group case for all inherited contexts. Fix this by also making inherit= use pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu contex= t. Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the group case. Fixes: bd2756811766 ("perf: Rewrite core context handling") Reported-by: Oliver Rosenberg Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Ian Rogers Link: https://patch.msgid.link/20260309133713.GB606826@noisy.programming.ki= cks-ass.net --- kernel/events/core.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 1f5699b..89b40e4 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -4813,7 +4813,7 @@ static void __perf_event_read(void *info) struct perf_event *sub, *event =3D data->event; struct perf_event_context *ctx =3D event->ctx; struct perf_cpu_context *cpuctx =3D this_cpu_ptr(&perf_cpu_context); - struct pmu *pmu =3D event->pmu; + struct pmu *pmu; =20 /* * If this is a task context, we need to check whether it is @@ -4825,7 +4825,7 @@ static void __perf_event_read(void *info) if (ctx->task && cpuctx->task_ctx !=3D ctx) return; =20 - raw_spin_lock(&ctx->lock); + guard(raw_spinlock)(&ctx->lock); ctx_time_update_event(ctx, event); =20 perf_event_update_time(event); @@ -4833,25 +4833,22 @@ static void __perf_event_read(void *info) perf_event_update_sibling_time(event); =20 if (event->state !=3D PERF_EVENT_STATE_ACTIVE) - goto unlock; + return; =20 if (!data->group) { - pmu->read(event); + perf_pmu_read(event); data->ret =3D 0; - goto unlock; + return; } =20 + pmu =3D event->pmu_ctx->pmu; pmu->start_txn(pmu, PERF_PMU_TXN_READ); =20 - pmu->read(event); - + perf_pmu_read(event); for_each_sibling_event(sub, event) perf_pmu_read(sub); =20 data->ret =3D pmu->commit_txn(pmu); - -unlock: - raw_spin_unlock(&ctx->lock); } =20 static inline u64 perf_event_count(struct perf_event *event, bool self) @@ -14744,7 +14741,7 @@ inherit_event(struct perf_event *parent_event, get_ctx(child_ctx); child_event->ctx =3D child_ctx; =20 - pmu_ctx =3D find_get_pmu_context(child_event->pmu, child_ctx, child_event= ); + pmu_ctx =3D find_get_pmu_context(parent_event->pmu_ctx->pmu, child_ctx, c= hild_event); if (IS_ERR(pmu_ctx)) { free_event(child_event); return ERR_CAST(pmu_ctx);