perf/core: Don't leak AUX buffer refcount on allocation failure

commit 5468c0fbccbb9d156522c50832244a8b722374fb upstream.

Failure of the AUX buffer allocation leaks the reference count.

Set the reference count to 1 only when the allocation succeeds.

Fixes: 45bfb2e50471 ("perf/core: Add AUX area to ring buffer for raw data streams")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/events/core.c b/kernel/events/core.c
index bf9f9eab6f67f8aab610a4aa5333f7633770171c..3c207cbfe3aac3f3af8f8799a575093c3429f7d9 100644 (file)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6290,9 +6290,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
                        goto unlock;
                }
 
-               atomic_set(&rb->aux_mmap_count, 1);
                user_extra = nr_pages;
-
                goto accounting;
        }
 
@@ -6394,8 +6392,10 @@ accounting:
        } else {
                ret = rb_alloc_aux(rb, event, vma->vm_pgoff, nr_pages,
                                   event->attr.aux_watermark, flags);
-               if (!ret)
+               if (!ret) {
+                       atomic_set(&rb->aux_mmap_count, 1);
                        rb->aux_mmap_locked = extra;
+               }
        }
 
 unlock:
@@ -6405,6 +6405,7 @@ unlock:
 
                atomic_inc(&event->mmap_count);
        } else if (rb) {
+               /* AUX allocation failed */
                atomic_dec(&rb->mmap_count);
        }
 aux_unlock: