perf: Ensure swevent hrtimer is properly destroyed

Peter Zijlstra · Peter Zijlstra · commit ff5860f5088e · 2026-01-05T08:55:54.000+01:00
With the change to hrtimer_try_to_cancel() in perf_swevent_cancel_hrtimer() it appears possible for the hrtimer to still be active by the time the event gets freed. Make sure the event does a full hrtimer_cancel() on the free path by installing a perf_event::destroy handler. Fixes: eb3182e ("perf/core: Fix system hang caused by cpu-clock usage") Reported-by: CyberUnicorns <a101e_iotvul@163.com> Tested-by: CyberUnicorns <a101e_iotvul@163.com> Debugged-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
diff --git a/kernel/events/core.c b/kernel/events/core.c
@@ -11906,6 +11906,11 @@ static void perf_swevent_cancel_hrtimer(struct perf_event *event)
 	}
 }
 
+static void perf_swevent_destroy_hrtimer(struct perf_event *event)
+{
+	hrtimer_cancel(&event->hw.hrtimer);
+}
+
 static void perf_swevent_init_hrtimer(struct perf_event *event)
 {
 	struct hw_perf_event *hwc = &event->hw;
@@ -11914,6 +11919,7 @@ static void perf_swevent_init_hrtimer(struct perf_event *event)
 		return;
 
 	hrtimer_setup(&hwc->hrtimer, perf_swevent_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
+	event->destroy = perf_swevent_destroy_hrtimer;
 
 	/*
 	 * Since hrtimers have a fixed rate, we can do a static freq->period

Original file line number	Diff line number	Diff line change
`@@ -11906,6 +11906,11 @@ static void perf_swevent_cancel_hrtimer(struct perf_event *event)`
`11906`	`11906`	`}`
`11907`	`11907`	`}`
`11908`	`11908`
	`11909`	`+static void perf_swevent_destroy_hrtimer(struct perf_event *event)`
	`11910`	`+{`
	`11911`	`+ hrtimer_cancel(&event->hw.hrtimer);`
	`11912`	`+}`
	`11913`	`+`
`11909`	`11914`	`static void perf_swevent_init_hrtimer(struct perf_event *event)`
`11910`	`11915`	`{`
`11911`	`11916`	`struct hw_perf_event *hwc = &event->hw;`
`@@ -11914,6 +11919,7 @@ static void perf_swevent_init_hrtimer(struct perf_event *event)`
`11914`	`11919`	`return;`
`11915`	`11920`
`11916`	`11921`	`hrtimer_setup(&hwc->hrtimer, perf_swevent_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);`
	`11922`	`+ event->destroy = perf_swevent_destroy_hrtimer;`
`11917`	`11923`
`11918`	`11924`	`/*`
`11919`	`11925`	`* Since hrtimers have a fixed rate, we can do a static freq->period`