The attach_perf_ctx_data() can race on global and !global cases.  The
global case is protected by global_ctx_data_rwsem and shares a single
reference count using perf_ctx_data.global field.

But when it races with !global case, it may miss to set the global field
and result in a reference count leak.

 CPU1                              CPU2
 ----------------------------------------------------------------
 attach_task_ctx_data(global=1)    attach_task_ctx_data(global=0)
   cd1 = alloc_perf_ctx_data()       cd2 = alloc_perf_ctx_data()
                                       try_cmpxchg() // ok
                                       // task->perf_ctx_data = cd2
     try_cmpxchg()            // fail; old = cd2; global = 0
     refcount_inc_not_zero()  // cd2->refcount++;
     free_perf_ctx_data()     // cd1

Then later detach_global_ctx_data() will see the data but it's not
marked as global, so it won't call detach_task_ctx_data().

Assisted-by: Sashiko.dev:Gemini-3.1-pro
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
 kernel/events/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6d1f8bad7e1c5210..939436a168ba5ec2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5445,6 +5445,8 @@ attach_task_ctx_data(struct task_struct *task, struct kmem_cache *ctx_cache,
 		}
 
 		if (refcount_inc_not_zero(&old->refcount)) {
+			if (global)
+				old->global = true;
 			free_perf_ctx_data(cd); /* unused */
 			return 0;
 		}
-- 
2.53.0