stable: please backport 3b7a34aebbdf to 6.{6,12,13,14,15}.y ("perf: Fix dangling cgroup pointer in cpuctx")

[Ian Klatzco]

Hi all,

linux-6.12.y has the regression commit e9c928807239 ("perf/core: Fix
child_total_time_enabled accounting bug at task exit", backport of
mainline a3c3c6667) but is missing the follow-up fix commit 3b7a34aebbdf
("perf: Fix dangling cgroup pointer in cpuctx", Yeoreum Yun, mainline
v6.16-rc).

The following branches are impacted:

  linux-6.6.y
  linux-6.12.y
  linux-6.13.y
  linux-6.14.y
  linux-6.15.y

The regression silently bypasses perf_cgroup_event_disable() on the
event-removal path when the event is non-ACTIVE at close time, leaving
cpuctx->cgrp dangling at a soon-to-be-freed perf_cgroup struct.  See
3b7a34aebbdf's commit message for the precise description.

The minimum viable patch is as follows:

    @@ in __perf_remove_from_context, after event_sched_out(...):
    +    if (event->state > PERF_EVENT_STATE_OFF)
    +        perf_cgroup_event_disable(event, ctx);
    +

I can prepare per-branch backports if useful; please let me know.

 - Ian Klatzco