[PATCH v3] s390/pai: Handle multiple PMU stop callback invocations

[Thomas Richter <tmricht@linux.ibm.com>]

Handle the following scenario:
The kernel protects itself against a very high sampling load and
throttles the sampling using:

  perf_event_throttle() --> PMU->stop()

Shortly later the scheduler may terminate the task and removes it from the
CPU. It again calls

  PMU->stop()

which results in two invocations of PMU->stop() called back to back.
Protect against this and check the PERF_HES_STOPPED bit on function
entry.  If it is already set return.
Clear bit PERF_HES_STOPPED in PMU->start().

Also fix unsafe iteration over syswide_list in pai_have_samples()
which might lead to a kernel crash (LIST_POISON dereference) if an
event overflows and is synchronously throttled during the loop.

Move calls to perf_sched_cb_inc() and perf_sched_cb_dec() to
functions pai_add() and pai_del() to avoid list corruption during
event throttling processing.

 #Cc: stable@vger.kernel.org # v6.19+
Fixes: 9f66572f2889 ("s390/pai_crypto: Enable per-task and system-wide sampling event")
Fixes: 582cc1b28e8c ("s390/pai_ext: Enable per-task and system-wide sampling event")

Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/perf_pai.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/arch/s390/kernel/perf_pai.c b/arch/s390/kernel/perf_pai.c
index cdb8006220ca..388941d9aec1 100644
--- a/arch/s390/kernel/perf_pai.c
+++ b/arch/s390/kernel/perf_pai.c
@@ -456,14 +456,13 @@ static void pai_start(struct perf_event *event, int flags,
 		local64_set(&event->hw.prev_count, sum);
 	} else {				/* Sampling */
 		memcpy((void *)PAI_SAVE_AREA(event), cpump->area, pp->area_size);
-		/* Enable context switch callback for system-wide sampling */
 		if (!(event->attach_state & PERF_ATTACH_TASK)) {
 			list_add_tail(PAI_SWLIST(event), &cpump->syswide_list);
-			perf_sched_cb_inc(event->pmu);
 		} else {
 			cpump->event = event;
 		}
 	}
+	event->hw.state &= ~PERF_HES_STOPPED;
 }
 
 static void paicrypt_start(struct perf_event *event, int flags)
@@ -492,6 +491,9 @@ static int pai_add(struct perf_event *event, int flags)
 			local_ctl_set_bit(0, CR0_PAI_EXTENSION_BIT);
 		}
 	}
+	/* Enable context switch callback for system-wide sampling */
+	if (!(event->attach_state & PERF_ATTACH_TASK))
+		perf_sched_cb_inc(event->pmu);
 	if (flags & PERF_EF_START)
 		pai_pmu[idx].pmu->start(event, PERF_EF_RELOAD);
 	event->hw.state = 0;
@@ -510,11 +512,17 @@ static void pai_stop(struct perf_event *event, int flags)
 	struct pai_mapptr *mp = this_cpu_ptr(pai_root[idx].mapptr);
 	struct pai_map *cpump = mp->mapptr;
 
+	/* Cope with multiple invocations:
+	 *   1. perf_event_throttle() --> PMU->stop()
+	 *   2. task schedules out --> PMU->stop()
+	 * Check for event already stopped.
+	 */
+	if (event->hw.state & PERF_HES_STOPPED)
+		return;
 	if (!event->attr.sample_period) {	/* Counting */
 		pai_pmu[idx].pmu->read(event);
 	} else {				/* Sampling */
 		if (!(event->attach_state & PERF_ATTACH_TASK)) {
-			perf_sched_cb_dec(event->pmu);
 			list_del(PAI_SWLIST(event));
 		} else {
 			pai_have_sample(event, cpump);
@@ -537,6 +545,9 @@ static void pai_del(struct perf_event *event, int flags)
 	struct paiext_cb *pcb = cpump->paiext_cb;
 
 	pai_pmu[idx].pmu->stop(event, PERF_EF_UPDATE);
+	/* Disable context switch callback for system-wide sampling */
+	if (!(event->attach_state & PERF_ATTACH_TASK))
+		perf_sched_cb_dec(event->pmu);
 	if (--cpump->active_events == 0) {
 		if (!pcb) {		/* PAI crypto */
 			local_ctl_clear_bit(0, CR0_CRYPTOGRAPHY_COUNTER_BIT);
@@ -672,9 +683,9 @@ static void pai_have_samples(int idx)
 {
 	struct pai_mapptr *mp = this_cpu_ptr(pai_root[idx].mapptr);
 	struct pai_map *cpump = mp->mapptr;
-	struct perf_event *event;
+	struct perf_event *event, *e2;
 
-	list_for_each_entry(event, &cpump->syswide_list, hw.tp_list)
+	list_for_each_entry_safe(event, e2, &cpump->syswide_list, hw.tp_list)
 		pai_have_sample(event, cpump);
 }
 
-- 
2.55.0