From: Thomas Gleixner Date: Sat, 2 Aug 2025 10:39:39 +0000 (+0200) Subject: perf/core: Don't leak AUX buffer refcount on allocation failure X-Git-Tag: v6.6.102~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f07ab7a4b572fa0a6fef26df54c1a1c6710c07ca;p=thirdparty%2Fkernel%2Fstable.git perf/core: Don't leak AUX buffer refcount on allocation failure commit 5468c0fbccbb9d156522c50832244a8b722374fb upstream. Failure of the AUX buffer allocation leaks the reference count. Set the reference count to 1 only when the allocation succeeds. Fixes: 45bfb2e50471 ("perf/core: Add AUX area to ring buffer for raw data streams") Signed-off-by: Thomas Gleixner Reviewed-by: Lorenzo Stoakes Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- diff --git a/kernel/events/core.c b/kernel/events/core.c index 3a33d9c1b1b2b..abde2ca104a5e 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6595,9 +6595,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) goto unlock; } - atomic_set(&rb->aux_mmap_count, 1); user_extra = nr_pages; - goto accounting; } @@ -6699,8 +6697,10 @@ accounting: } else { ret = rb_alloc_aux(rb, event, vma->vm_pgoff, nr_pages, event->attr.aux_watermark, flags); - if (!ret) + if (!ret) { + atomic_set(&rb->aux_mmap_count, 1); rb->aux_mmap_locked = extra; + } } unlock: @@ -6710,6 +6710,7 @@ unlock: atomic_inc(&event->mmap_count); } else if (rb) { + /* AUX allocation failed */ atomic_dec(&rb->mmap_count); } aux_unlock: