stable: please backport 3b7a34aebbdf to 6.{6,12,13,14,15}.y ("perf: Fix dangling cgroup pointer in cpuctx")

stable: please backport 3b7a34aebbdf to 6.{6,12,13,14,15}.y ("perf: Fix dangling cgroup pointer in cpuctx")

[Ian Klatzco]

Hi all,

linux-6.12.y has the regression commit e9c928807239 ("perf/core: Fix
child_total_time_enabled accounting bug at task exit", backport of
mainline a3c3c6667) but is missing the follow-up fix commit 3b7a34aebbdf
("perf: Fix dangling cgroup pointer in cpuctx", Yeoreum Yun, mainline
v6.16-rc).

The following branches are impacted:

  linux-6.6.y
  linux-6.12.y
  linux-6.13.y
  linux-6.14.y
  linux-6.15.y

The regression silently bypasses perf_cgroup_event_disable() on the
event-removal path when the event is non-ACTIVE at close time, leaving
cpuctx->cgrp dangling at a soon-to-be-freed perf_cgroup struct.  See
3b7a34aebbdf's commit message for the precise description.

The minimum viable patch is as follows:

    @@ in __perf_remove_from_context, after event_sched_out(...):
    +    if (event->state > PERF_EVENT_STATE_OFF)
    +        perf_cgroup_event_disable(event, ctx);
    +

I can prepare per-branch backports if useful; please let me know.

 - Ian Klatzco

Re: stable: please backport 3b7a34aebbdf to 6.{6,12,13,14,15}.y ("perf: Fix dangling cgroup pointer in cpuctx")

[Greg KH]

On Wed, May 27, 2026 at 05:25:13PM -0700, Ian Klatzco wrote:
> Hi all,
> 
> linux-6.12.y has the regression commit e9c928807239 ("perf/core: Fix
> child_total_time_enabled accounting bug at task exit", backport of
> mainline a3c3c6667) but is missing the follow-up fix commit 3b7a34aebbdf
> ("perf: Fix dangling cgroup pointer in cpuctx", Yeoreum Yun, mainline
> v6.16-rc).
> 
> The following branches are impacted:
> 
>   linux-6.6.y
>   linux-6.12.y
>   linux-6.13.y
>   linux-6.14.y
>   linux-6.15.y
> 
> The regression silently bypasses perf_cgroup_event_disable() on the
> event-removal path when the event is non-ACTIVE at close time, leaving
> cpuctx->cgrp dangling at a soon-to-be-freed perf_cgroup struct.  See
> 3b7a34aebbdf's commit message for the precise description.
> 
> The minimum viable patch is as follows:
> 
>     @@ in __perf_remove_from_context, after event_sched_out(...):
>     +    if (event->state > PERF_EVENT_STATE_OFF)
>     +        perf_cgroup_event_disable(event, ctx);
>     +
> 
> I can prepare per-branch backports if useful; please let me know.

Please send backports for the trees we currently support (as listed on
the front page of kernel.org).

thanks,

greg k-h

Re: stable: please backport 3b7a34aebbdf to 6.{6,12,13,14,15}.y ("perf: Fix dangling cgroup pointer in cpuctx")

[Sasha Levin]

Queued for 6.6.y and 6.12.y, thanks.

-- 
Thanks,
Sasha