linux-kernel - [tip: perf/urgent] perf: Ensure swevent hrtimer is properly destroyed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <176759987385.510.3913340745145777460.tip-bot2@tip-bot2>
Date: Mon, 05 Jan 2026 07:57:53 -0000
From: "tip-bot2 for Peter Zijlstra" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: CyberUnicorns <a101e_iotvul@....com>,
 "Peter Zijlstra (Intel)" <peterz@...radead.org>, x86@...nel.org,
 linux-kernel@...r.kernel.org
Subject: [tip: perf/urgent] perf: Ensure swevent hrtimer is properly destroyed

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     ff5860f5088e9076ebcccf05a6ca709d5935cfa9
Gitweb:        https://git.kernel.org/tip/ff5860f5088e9076ebcccf05a6ca709d5935cfa9
Author:        Peter Zijlstra <peterz@...radead.org>
AuthorDate:    Sat, 20 Dec 2025 14:14:41 +01:00
Committer:     Peter Zijlstra <peterz@...radead.org>
CommitterDate: Mon, 05 Jan 2026 08:55:54 +01:00

perf: Ensure swevent hrtimer is properly destroyed

With the change to hrtimer_try_to_cancel() in
perf_swevent_cancel_hrtimer() it appears possible for the hrtimer to
still be active by the time the event gets freed.

Make sure the event does a full hrtimer_cancel() on the free path by
installing a perf_event::destroy handler.

Fixes: eb3182ef0405 ("perf/core: Fix system hang caused by cpu-clock usage")
Reported-by: CyberUnicorns <a101e_iotvul@....com>
Tested-by: CyberUnicorns <a101e_iotvul@....com>
Debugged-by: Thomas Gleixner <tglx@...utronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
---
 kernel/events/core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index dad0d3d..e3d8338 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -11906,6 +11906,11 @@ static void perf_swevent_cancel_hrtimer(struct perf_event *event)
 	}
 }
 
+static void perf_swevent_destroy_hrtimer(struct perf_event *event)
+{
+	hrtimer_cancel(&event->hw.hrtimer);
+}
+
 static void perf_swevent_init_hrtimer(struct perf_event *event)
 {
 	struct hw_perf_event *hwc = &event->hw;
@@ -11914,6 +11919,7 @@ static void perf_swevent_init_hrtimer(struct perf_event *event)
 		return;
 
 	hrtimer_setup(&hwc->hrtimer, perf_swevent_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
+	event->destroy = perf_swevent_destroy_hrtimer;
 
 	/*
 	 * Since hrtimers have a fixed rate, we can do a static freq->period