APPLIED: [SRU][R/N][PATCH 0/2] [UBUNTU 24.04] kernel: CPU hotplug unsupported by CPUMF (LP: #2165732)

[Stefan Bader]

On 03/09/2026 18:01, Massimiliano Pellizzer via kernel-team wrote:
> BugLink: https://bugs.launchpad.net/bugs/2165732
> 
> [Impact]
> 
> s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
> The command 'perf stat -e cycles -- <command>' crashes the kernel
> when CPUs are hotplug added during that run.
> 
> Root cause is the allocation of struct cpu_cf_events at first
> event initialization. The allocation is dynamic and the first
> event that has task context creates such a structure for
> each online CPU. This is not sufficient. CPUs may be offline
> during event creation and can be set online during the
> perf run time. For example commands
> 
>   # echo 0 > /sys/devices/system/cpu/cpu1/online
>   # perf stat -e cycles -i -- stress-ng -t10s --matrix X
>   # sleep 1
>   # echo 1 > /sys/devices/system/cpu/cpu1/online
> 
> create an event for CPUs 0,2-X. Since the events are created with
> task-context, the scheduler will eventually schedule the program
> on CPU1. This CPU has not created and initialized any per
> CPU event infrastructure as that CPU was not online at the time
> of the perf invocation. Thus when the scheduler runs stress-ng
> on CPU1, the function cpumf_pmu_add() refers to a NULL pointer:
> 
>   struct cpu_cf_events *cpuhw = this_cpu_cfhw();
> 
> This function call is invoked after the task stress-ng has been
> made runnable on CPU1. And this_cpu_cfhw() returns NULL.
> 
> The result is a panic.
> 
> The issue arises only in per-task context when the CPUMF facility is
> used and the scheduler picks a random CPU for such a process to run on.
> The scheduler enables the CPUMF infrastructure via PMU callback
> functions pmu::add() and pmu::del().
> 
> Introduce a CPU hotplug prepare/dead callback pair which creates and
> removes the per CPU counter data while the CPU is offline. Count the
> users which track every CPU (cpu == -1), that is perf_event_open()
> events with task context and /dev/hwctr device sessions, in the new
> counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex.
> This ensures the infrastructure is available when
> new CPU is selected to run the per-task context process.
> 
> In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference
> pointer to data structures is set to NULL before the data is freed
> to prevent interrupt handlers to access stale data.
> 
> [Fix]
> 
> Backport commit:
> - 337bd95507a1 ("s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks")
> 
> [Test Plan]
> 
> Run the following commands:
> # echo 0 > /sys/devices/system/cpu/cpu1/online
> # perf stat -e cycles -i -- stress-ng -t10s --matrix X
> # sleep 1
> # echo 1 > /sys/devices/system/cpu/cpu1/online
> 
> [Regression Potential]
> 
> The change is confined to arch/s390/kernel/perf_cpum_cf.c,
> affecting only s390 systems using the CPU-Measurement Counter Facility PMU.
> It reworks locking and reference counting and adds two new CPU hotplug callbacks
> that now run on every hotplug transition on affected systems.
> A bookkeeping mismatch in the new tskctx counter or a lock-ordering error
> could reintroduce use-after-free or refcount bugs similar to the one being
> fixed.
> 
> 

Applied to resolute,noble:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260917/dac4848e/attachment.sig>