Patch "s390/pai: fix sampling event removal for PMU device driver" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    s390/pai: fix sampling event removal for PMU device driver

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     s390-pai-fix-sampling-event-removal-for-pmu-device-d.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit edd91f101651c22faf624630ff57b9e477f6ea65
Author: Thomas Richter <tmricht@xxxxxxxxxxxxx>
Date:   Thu Feb 29 15:00:28 2024 +0100

    s390/pai: fix sampling event removal for PMU device driver
    
    [ Upstream commit e9f3af02f63909f41b43c28330434cc437639c5c ]
    
    In case of a sampling event, the PAI PMU device drivers need a
    reference to this event.  Currently to PMU device driver reference
    is removed when a sampling event is destroyed. This may lead to
    situations where the reference of the PMU device driver is removed
    while being used by a different sampling event.
    Reset the event reference pointer of the PMU device driver when
    a sampling event is deleted and before the next one might be added.
    
    Fixes: 39d62336f5c1 ("s390/pai: add support for cryptography counters")
    Signed-off-by: Thomas Richter <tmricht@xxxxxxxxxxxxx>
    Acked-by: Sumanth Korikkar <sumanthk@xxxxxxxxxxxxx>
    Signed-off-by: Vasily Gorbik <gor@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c
index 65cc74ab4cdd8..1eefbe2ff4189 100644
--- a/arch/s390/kernel/perf_pai_crypto.c
+++ b/arch/s390/kernel/perf_pai_crypto.c
@@ -53,7 +53,6 @@ static void paicrypt_event_destroy(struct perf_event *event)
 {
 	struct paicrypt_map *cpump = per_cpu_ptr(&paicrypt_map, event->cpu);
 
-	cpump->event = NULL;
 	static_branch_dec(&pai_key);
 	mutex_lock(&pai_reserve_mutex);
 	debug_sprintf_event(cfm_dbg, 5, "%s event %#llx cpu %d users %d"
@@ -278,10 +277,15 @@ static int paicrypt_add(struct perf_event *event, int flags)
 
 static void paicrypt_stop(struct perf_event *event, int flags)
 {
-	if (!event->attr.sample_period)	/* Counting */
+	struct paicrypt_mapptr *mp = this_cpu_ptr(paicrypt_root.mapptr);
+	struct paicrypt_map *cpump = mp->mapptr;
+
+	if (!event->attr.sample_period) {	/* Counting */
 		paicrypt_read(event);
-	else				/* Sampling */
+	} else {				/* Sampling */
 		perf_sched_cb_dec(event->pmu);
+		cpump->event = NULL;
+	}
 	event->hw.state = PERF_HES_STOPPED;
 }
 
diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c
index bac95261ec46d..a9235071ca70b 100644
--- a/arch/s390/kernel/perf_pai_ext.c
+++ b/arch/s390/kernel/perf_pai_ext.c
@@ -122,7 +122,6 @@ static void paiext_event_destroy(struct perf_event *event)
 	struct paiext_map *cpump = mp->mapptr;
 
 	mutex_lock(&paiext_reserve_mutex);
-	cpump->event = NULL;
 	if (refcount_dec_and_test(&cpump->refcnt))	/* Last reference gone */
 		paiext_free(mp);
 	paiext_root_free();
@@ -355,10 +354,15 @@ static int paiext_add(struct perf_event *event, int flags)
 
 static void paiext_stop(struct perf_event *event, int flags)
 {
-	if (!event->attr.sample_period)	/* Counting */
+	struct paiext_mapptr *mp = this_cpu_ptr(paiext_root.mapptr);
+	struct paiext_map *cpump = mp->mapptr;
+
+	if (!event->attr.sample_period) {	/* Counting */
 		paiext_read(event);
-	else				/* Sampling */
+	} else {				/* Sampling */
 		perf_sched_cb_dec(event->pmu);
+		cpump->event = NULL;
+	}
 	event->hw.state = PERF_HES_STOPPED;
 }