diff --git a/kernel/events/core.c b/kernel/events/core.c index 32b7ca93a75a2161208ec09d2f518e6d32d52e38..d8a33cbc9fe3555180db7607a2fad59cde00b9d9 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -1228,10 +1228,17 @@ static void perf_group_detach(struct perf_event *event) * If this was a group event with sibling events then * upgrade the siblings to singleton events by adding them * to whatever list we are on. + * If this isn't on a list, make sure we still remove the sibling's + * group_entry from this sibling_list; otherwise, when that sibling + * is later deallocated, it will try to remove itself from this + * sibling_list, which may well have been deallocated already, + * resulting in a use-after-free. */ list_for_each_entry_safe(sibling, tmp, &event->sibling_list, group_entry) { if (list) list_move_tail(&sibling->group_entry, list); + else + list_del_init(&sibling->group_entry); sibling->group_leader = sibling; /* Inherit group flags from the previous leader */