1 files changed, 9 insertions, 0 deletions

diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 009467a60578..4b5f8d932400 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -48,6 +48,15 @@ static void perf_output_put_handle(struct perf_output_handle *handle)
         unsigned long head;
 
 again:
+        /*
+         * In order to avoid publishing a head value that goes backwards,
+         * we must ensure the load of @rb->head happens after we've
+         * incremented @rb->nest.
+         *
+         * Otherwise we can observe a @rb->head value before one published
+         * by an IRQ/NMI happening between the load and the increment.
+         */
+        barrier();
         head = local_read(&rb->head);
 
         /*