[PATCH] perf/core: Remove group siblings before the leader in move_group

[Jun Yang <juny24602@gmail.com>]

From: Jun Yang <junvyyang@tencent.com>

During group migration, perf_event_open() removes the group leader before
its siblings. The context's active lists contain only group leaders, so a
concurrent context switch can no longer reach the remaining active
siblings after the leader has been removed.

The context can then become inactive while those siblings are still
active. Removing a sibling in this state takes the inactive-context path
and calls pmu->del() on the calling CPU rather than the CPU where the event
is running.

Remove the siblings first so that a concurrent context switch can still
schedule them out through the leader.

Fixes: bd2756811766 ("perf: Rewrite core context handling")
Cc: stable@kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Assisted-by: tencentos-corvus-ai:kimi-k3
Signed-off-by: Jun Yang <junvyyang@tencent.com>
---
A KASAN reproducer for this issue is available if requested.

 kernel/events/core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index fe33fe1..5bf8053 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -14230,14 +14230,15 @@ SYSCALL_DEFINE5(perf_event_open,
 	 */
 
 	if (move_group) {
-		perf_remove_from_context(group_leader, 0);
-		put_pmu_ctx(group_leader->pmu_ctx);
-
+		/* Keep siblings reachable by group_sched_out(). */
 		for_each_sibling_event(sibling, group_leader) {
 			perf_remove_from_context(sibling, 0);
 			put_pmu_ctx(sibling->pmu_ctx);
 		}
 
+		perf_remove_from_context(group_leader, 0);
+		put_pmu_ctx(group_leader->pmu_ctx);
+
 		/*
 		 * Install the group siblings before the group leader.
 		 *
-- 
2.54.0 (Apple Git-157)