1 files changed, 9 insertions, 8 deletions

diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 383cde476176..6ed16ecfd0a3 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -141,15 +141,7 @@ int perf_output_begin(struct perf_output_handle *handle,
         perf_output_get_handle(handle);
 
         do {
-                /*
-                 * Userspace could choose to issue a mb() before updating the
-                 * tail pointer. So that all reads will be completed before the
-                 * write is issued.
-                 *
-                 * See perf_output_put_handle().
-                 */
                 tail = ACCESS_ONCE(rb->user_page->data_tail);
-                smp_mb();
                 offset = head = local_read(&rb->head);
                 if (!rb->overwrite &&
                     unlikely(CIRC_SPACE(head, tail, perf_data_size(rb)) < size))
@@ -157,6 +149,15 @@ int perf_output_begin(struct perf_output_handle *handle,
                 head += size;
         } while (local_cmpxchg(&rb->head, offset, head) != offset);
 
+        /*
+         * Separate the userpage->tail read from the data stores below.
+         * Matches the MB userspace SHOULD issue after reading the data
+         * and before storing the new tail position.
+         *
+         * See perf_output_put_handle().
+         */
+        smp_mb();
+
         if (unlikely(head - local_read(&rb->wakeup) > rb->watermark))
                 local_add(rb->watermark, &rb->wakeup);