[tip: perf/urgent] perf: Fix perf_remove_from_context() event scheduling

[tip-bot2 for Peter Zijlstra]

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     d095321349222961813333277881b3c74f10b17b
Gitweb:        https://git.kernel.org/tip/d095321349222961813333277881b3c74f10b17b
Author:        Peter Zijlstra <peterz@xxxxxxxxxxxxx>
AuthorDate:    Wed, 14 Oct 2026 14:45:51 +02:00
Committer:     Peter Zijlstra <peterz@xxxxxxxxxxxxx>
CommitterDate: Fri, 23 Oct 2026 19:09:52 +02:00

perf: Fix perf_remove_from_context() event scheduling

Q8 noted that it is possible to get into an inconsistent state when
using perf_remove_from_context() on a group leader event.

Specifically, when the leader gets scheduled out, we should (when not
destroying the grouping) schedule out the complete group, similar to
__perf_event_disable().

Reported-by: Q8 <cipher.gnep@xxxxxxxxx>
Tested-by: Q8 <cipher.gnep@xxxxxxxxx>
Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
---
 kernel/events/core.c |  9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index e248f34..f36a3bb 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2590,6 +2590,7 @@ __perf_remove_from_context(struct perf_event *event,
 	enum perf_event_state state = PERF_EVENT_STATE_OFF;
 	unsigned long flags = (unsigned long)info;
 
+	perf_pmu_disable(pmu_ctx->pmu);
 	ctx_time_update(cpuctx, ctx);
 
 	/*
@@ -2603,6 +2604,13 @@ __perf_remove_from_context(struct perf_event *event,
 	if (flags & DETACH_DEAD)
 		state = PERF_EVENT_STATE_DEAD;
 
+	/*
+	 * When disabling a group leader, the whole group becomes ineligible
+	 * to run, so schedule out the full group.
+	 */
+	if (!(flags & DETACH_GROUP) && event == event->group_leader)
+		group_sched_out(event, ctx);
+
 	__event_disable(event, ctx, state);
 
 	if (flags & DETACH_GROUP)
@@ -2632,6 +2640,7 @@ __perf_remove_from_context(struct perf_event *event,
 			cpuctx->task_ctx = NULL;
 		}
 	}
+	perf_pmu_enable(pmu_ctx->pmu);
 }
 
 /*