[PATCH 0/2] perf/core: fix perf_mmap alias charging and the redirected-event AUX mmap

[PATCH 0/2] perf/core: fix perf_mmap alias charging and the redirected-event AUX mmap

[Joshua Warren]

Two perf mmap() fixes in kernel/events/core.c.  Both defects are
present on torvalds/linux master 05441d697f7f9a927264f4058cbbc6a03dfcac9d,
the tree this series is based on.

Patch 1 stops duplicate alias mmaps of the ring buffer and of the AUX
area from charging the perf mlock gift (user->perf_mlock) twice: the
charge is taken once, at first allocation, and released once at final
close.  The excess was never removed, and perf_mmap_calc_limits()
clamps the recorded perf_mlock at the budget, so an inflated counter
pushes later allocations over into the RLIMIT_MEMLOCK side of the
accounting.

Patch 2 handles the first AUX mmap of a redirected event
(perf_event_set_output()): perf_mmap_aux() refcount_inc()s the event's
mmap_count from zero, which saturates the count and reports
REFCOUNT_ADD_UAF through REFCOUNT_CORRUPTION() (a WARN_ONCE(), or a
BUG() with CONFIG_BUG_ON_DATA_CORRUPTION=y).  A saturated count is
never released: a later AUX mmap() reports REFCOUNT_ADD_OVF once, while
perf_mmap_close() takes the saturated count silently and therefore
never detaches the event from the borrowed rb.  The AUX mmap
of a not-yet-mmaped event is now rejected with -EBUSY, matching the
ring mmap() stance.  The ring-side fix was
commit d06bf78e55d5 ("perf: Fix refcount warning on event->mmap_count
increment").

That is an observable behavior change: the first AUX mmap() of a
redirected event now fails with -EBUSY where it previously reported a
refcount error and saturated the event's mmap_count.  Only flows that
are already broken on this base are affected.

The patch 2 defect is availability only: the count saturates fail-safe,
and no use-after-free was found.  It is reachable by an unprivileged
user through perf_event_set_output() (PERF_FLAG_FD_OUTPUT) on AUX-capable
PMUs where userspace can create the AUX-owning event.  On a default
kernel the first such mmap() prints one warning; with panic_on_warn=1
that first warning panics the kernel, and with
CONFIG_BUG_ON_DATA_CORRUPTION=y the BUG() oopses the task regardless of
panic_on_warn.  The ring-side twin was fixed the same way.

Validation used source-level host harnesses that compile perf_mmap,
perf_mmap_rb, perf_mmap_aux, perf_mmap_close,
perf_mmap_account/unaccount/calc_limits straight from the tree and
drive full single-user, single-mm, single-thread lifecycles over them;
nothing runs in a kernel, and no runtime kernel reproduction was
performed:

- 22-case mmap-charge harness: the base fails 13 (per-alias
  user->perf_mlock charge leak), patch 1 alone passes 22/22, the series
  keeps 22/22 passing.
- redirect-lifecycle harness (33 scenarios): the base fails 22, patch 1
  alone fails exactly the 9 redirected-AUX scenarios (the redirected
  AUX mmap saturates mmap_count), the series passes 33/33.

The harnesses are tooling, not part of these changes.  The series is
compile-verified with a focused x86-64 defconfig build of
kernel/events/core.o; the kernel was not booted.

Kunwu Chan's "perf/core: add AUX buffer kernel-consumer API" (v2,
9 Oct 2026, <20261009160010.1829642-1-kunwu.chan@gmail.com>) is not
merged upstream, and its series changes no perf_mmap_rb()/
perf_mmap_aux() alias or mlock accounting line, so it does not overlap
these two fixes; both defects described here remain on the base named
above, with or without that series.

AI coding agents in the omp harness wrote the patches, the reproducer
and the measurements. I read every patch in this series before sending
it.

Joshua Warren (2):
  perf/core: Avoid charging mmap aliases twice
  perf/core: handle first AUX mmap on redirected events

 kernel/events/core.c | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

-- 
2.39.5

[PATCH 1/2] perf/core: Avoid charging mmap aliases twice

[Joshua Warren]

commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
user_extra = nr_pages above the rb and AUX branches of perf_mmap().
Before that change the alias paths (mmap() of an already-mapped ring
buffer or AUX area) reached the single charge site with user_extra = 0
and extra = 0.  After the hoist they carry the buffer's page count, so
every alias mmap() charges the perf mlock gift (user->perf_mlock) again,
through perf_mmap_account().  extra remains 0 on the alias paths, so
mm->pinned_vm is neither charged nor leaked by an alias -- the duplicate
charge is confined to user->perf_mlock.

The excess is never removed: the final close uncharges exactly the
first allocation's charge (perf_mmap_unaccount() for the ring buffer,
the AUX close path for AUX), so the per-alias charges stay on
user->perf_mlock.  Alias paths also charge without passing
perf_mmap_calc_limits(), and an alias mmap() that fails in map_range()
is torn down via perf_mmap_close(), which does not release the alias
charge either.

The inflated counter throttles later mmaps: perf_mmap_calc_limits()
clamps the recorded user->perf_mlock at the perf-event mlock budget
(sysctl_perf_event_mlock scaled by online CPUs) before adding a fresh
allocation's user_extra, so once the counter is inflated past the
budget, every fresh allocation spills its whole size out of the perf
mlock gift into mm->pinned_vm and is tested against RLIMIT_MEMLOCK
there, and can be denied with -EPERM even though the real usage fits
the budget.

Charge on first allocation only: drop the ring buffer alias-branch
charge and move the AUX charge from the common tail into the AUX
first-allocation branch.  Aliases share the existing charge and the
final close releases it exactly once, as before.

Tested with a host-level regression harness that compiles the
accounting code straight from this tree (perf_mmap, perf_mmap_rb,
perf_mmap_aux, perf_mmap_close, perf_mmap_account/unaccount/calc_limits
and the internal.h helpers) and drives full ring and AUX lifecycles
over it (single-user, single-mm, single-threaded; nothing runs in a
kernel): the unfixed tree leaves nonzero user->perf_mlock behind on
alias and failed-alias lifecycles, the fixed tree balances all 22.
The harness is tooling, not part of this change.  Compile-verified with a
focused x86-64 defconfig build of kernel/events/core.o; the kernel was
not booted and no runtime kernel reproduction was performed.

AI coding agents in the omp harness wrote the patches, the reproducer
and the measurements.

Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
Signed-off-by: Joshua Warren <joshua.s.warren@gmail.com>
---
 kernel/events/core.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 457d75ea7..c8bb805bc 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7332,9 +7332,11 @@ static int perf_mmap_rb(struct vm_area_struct
*vma, struct perf_event *event,
 		if (refcount_inc_not_zero(&event->rb->mmap_count)) {
 			/*
 			 * Success -- managed to mmap() the same buffer
-			 * multiple times.
+			 * multiple times. The alias shares the ring's
+			 * already-locked pages; the existing charge stays
+			 * as-is and is removed once, when the last mapping
+			 * closes.
 			 */
-			perf_mmap_account(vma, user_extra, extra);
 			refcount_inc(&event->mmap_count);
 			return 0;
 		}
@@ -7443,9 +7445,16 @@ static int perf_mmap_aux(struct vm_area_struct
*vma, struct perf_event *event,

 		refcount_set(&rb->aux_mmap_count, 1);
 		rb->aux_mmap_locked = extra;
+
+		/*
+		 * Charge the AUX area once, at first allocation. The alias
+		 * branch above shares the already-locked pages and adds no
+		 * charge; the single charge is removed when the last AUX
+		 * mapping closes.
+		 */
+		perf_mmap_account(vma, user_extra, extra);
 	}

-	perf_mmap_account(vma, user_extra, extra);
 	refcount_inc(&event->mmap_count);

 	return 0;
-- 
2.39.5

[PATCH 2/2] perf/core: handle first AUX mmap on redirected events

[Joshua Warren]

A redirected event (perf_event_set_output()) enters perf_mmap_aux()
with mmap_count == 0: its first mmap() can only be the AUX mmap, since
perf_mmap_rb() rejects count-0 events with -EBUSY.  The ring-side fix
is commit d06bf78e55d5 ("perf: Fix refcount warning on
event->mmap_count increment").  The
tail refcount_inc() from zero saturates the count and reports
REFCOUNT_ADD_UAF, which refcount_warn_saturate() raises through
REFCOUNT_CORRUPTION(): a WARN_ONCE() normally, but a BUG() when
CONFIG_BUG_ON_DATA_CORRUPTION=y.  A saturated count is never released:
a later AUX mmap() of the event adds to the saturated count and reports
REFCOUNT_ADD_OVF (a WARN_ONCE(), silent after its first report), while
perf_mmap_close() takes the saturated count silently --
refcount_dec_and_mutex_lock() fails without warning -- so the close
path that detaches the event from the borrowed rb can never run.

Reject the AUX mmap() of a not-yet-mmaped event with -EBUSY, matching
the ring mmap() stance: the redirect keeps the state
perf_event_set_output() left it in, and the shared rb's counters and
its user and mm accounting stay untouched.  As on the ring side, the
reject avoids creating a mapping that aliases the borrowed rb, so the
shared user_page and AUX area remain the owner's alone.

This changes observable behavior: the first AUX mmap() of a redirected
event now fails with -EBUSY where it previously reported a refcount
error and saturated the event's mmap_count.  Only flows that are already
broken on this base are affected: a redirected event's ring mmap() is
rejected with -EBUSY already, so its AUX mmap() could only ever report
that error and saturate.

The impact of the defect is availability only: the count saturates
fail-safe, and no use-after-free was found.  The defect is reachable by
an unprivileged user through perf_event_set_output() (PERF_FLAG_FD_OUTPUT)
on AUX-capable PMUs where userspace can create the AUX-owning event.  On
a default kernel the first such mmap() prints one warning.  With
panic_on_warn=1 that first warning panics the kernel, and with
CONFIG_BUG_ON_DATA_CORRUPTION=y the BUG() oopses the task regardless of
panic_on_warn.

Tested with a source-level host harness that compiles perf_mmap,
perf_mmap_rb, perf_mmap_aux, perf_mmap_close,
perf_mmap_account/unaccount/calc_limits straight from this tree and
drives full ring, AUX and redirected-event lifecycles over them
(single-user, single-mm, single-threaded; nothing runs in a kernel):
the previous commit's source fails the nine redirected-AUX scenarios
(the AUX mmap of a redirected event saturates mmap_count), this source
passes all 33, and the 22-case alias-charge harness still passes.
The harness is tooling, not part of this change.  Compile-verified with a
focused x86-64 defconfig build of kernel/events/core.o; the kernel was
not booted and no runtime kernel reproduction was performed.

AI coding agents in the omp harness wrote the patches, the reproducer
and the measurements.

Fixes: 448f97fba901 ("perf: Convert mmap() refcounts to refcount_t")
Signed-off-by: Joshua Warren <joshua.s.warren@gmail.com>
---
 kernel/events/core.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index c8bb805bc..d336e5747 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7419,6 +7419,17 @@ static int perf_mmap_aux(struct vm_area_struct
*vma, struct perf_event *event,
 	if (!is_power_of_2(nr_pages))
 		return -EINVAL;

+	/*
+	 * A redirected event (perf_event_set_output()) arrives here with
+	 * mmap_count == 0; perf_mmap_rb() rejects its ring mmap() with
+	 * -EBUSY.  Reject its AUX mmap() the same way: the tail
+	 * refcount_inc() below would raise mmap_count from zero, which
+	 * WARNs and saturates the count, and a saturated count cannot be
+	 * released by perf_mmap_close().
+	 */
+	if (!refcount_read(&event->mmap_count))
+		return -EBUSY;
+
 	if (!refcount_inc_not_zero(&rb->mmap_count))
 		return -EINVAL;

-- 
2.39.5