[PATCH 2/2] perf/core: Cancel PMU mux hrtimer before freeing per-CPU context

[Dapeng Mi <dapeng1.mi@linux.intel.com>]

perf_pmu_free() can free the PMU's per-CPU perf_cpu_pmu_context while
the multiplexing hrtimer is still armed. Once the timer expires, it
dereferences the freed cpc and can crash the kernel.

Cancel the multiplexing hrtimer before freeing the PMU context by adding
a perf_mux_cancel_hrtimer() helper and invoking it from the PMU free
path.

Reported-by: Hanxiang Xu <xuhx@hust.edu.cn>
Closes: https://lore.kernel.org/all/ca4f133.14714.1a162b8654c.Coremail.xuhx@hust.edu.cn/
Fixes: 8f4c4963d283 ("perf/core: Simplify the perf_pmu_register() error path")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
---
 kernel/events/core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index e088c31534bc..54eb962ab6ff 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1316,6 +1316,12 @@ static void __perf_mux_hrtimer_init(struct perf_cpu_pmu_context *cpc, int cpu)
 		      HRTIMER_MODE_ABS_PINNED_HARD);
 }
 
+static void perf_mux_cancel_hrtimer(struct perf_cpu_pmu_context *cpc)
+{
+	cpc->hrtimer_active = 0;
+	hrtimer_cancel(&cpc->hrtimer);
+}
+
 static int perf_mux_hrtimer_restart(struct perf_cpu_pmu_context *cpc)
 {
 	struct hrtimer *timer = &cpc->hrtimer;
@@ -13024,6 +13030,7 @@ static void perf_pmu_free(struct pmu *pmu)
 			cpc = *per_cpu_ptr(pmu->cpu_pmu_context, cpu);
 			if (!cpc)
 				continue;
+			perf_mux_cancel_hrtimer(cpc);
 			if (cpc->epc.embedded) {
 				/* refcount managed */
 				put_pmu_ctx(&cpc->epc);
-- 
2.34.1