--- /dev/null
+From 28a967c3a2f99fa3b5f762f25cb2a319d933571b Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Wed, 24 Feb 2016 18:45:46 +0100
+Subject: perf: Cure event->pending_disable race
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 28a967c3a2f99fa3b5f762f25cb2a319d933571b upstream.
+
+Because event_sched_out() checks event->pending_disable _before_
+actually disabling the event, it can happen that the event fires after
+it checks but before it gets disabled.
+
+This would leave event->pending_disable set and the queued irq_work
+will try and process it.
+
+However, if the event trigger was during schedule(), the event might
+have been de-scheduled by the time the irq_work runs, and
+perf_event_disable_local() will fail.
+
+Fix this by checking event->pending_disable _after_ we call
+event->pmu->del(). This depends on the latter being a compiler
+barrier, such that the compiler does not lift the load and re-creates
+the problem.
+
+Tested-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: dvyukov@google.com
+Cc: eranian@google.com
+Cc: oleg@redhat.com
+Cc: panand@redhat.com
+Cc: sasha.levin@oracle.com
+Cc: vince@deater.net
+Link: http://lkml.kernel.org/r/20160224174948.040469884@infradead.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1400,14 +1400,14 @@ event_sched_out(struct perf_event *event
+
+ perf_pmu_disable(event->pmu);
+
++ event->tstamp_stopped = tstamp;
++ event->pmu->del(event, 0);
++ event->oncpu = -1;
+ event->state = PERF_EVENT_STATE_INACTIVE;
+ if (event->pending_disable) {
+ event->pending_disable = 0;
+ event->state = PERF_EVENT_STATE_OFF;
+ }
+- event->tstamp_stopped = tstamp;
+- event->pmu->del(event, 0);
+- event->oncpu = -1;
+
+ if (!is_software_event(event))
+ cpuctx->active_oncpu--;