[PATCH] perf/core: fix locked_vm leak on alias mmap() and cross-MM pinned_vm underflow

[PATCH] perf/core: fix locked_vm leak on alias mmap() and cross-MM pinned_vm underflow

[Hui Peng]

In perf_mmap(), mapping an output ring buffer onto an event via
PERF_EVENT_IOC_SET_OUTPUT / alias mmap() increments user->locked_vm and
mm->pinned_vm without recording the accounting MM on the ring_buffer or
releasing user_extra onperf_mmap_close(), causing a permanent locked_vm
leak and a cross-MM pinned_vm underflow when the mapping is closed in a
different process. Store the accounted mm_struct on struct perf_buffer
and unaccount against the original mm_struct on close.

Fixes: fae85b7c8bcc ("perf: Start the restructuring")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/kernel/events/core.c b/kernel/events/core.c
index fe33fe15689d..2be9301dcd7c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7050,7 +7050,11 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 
 		/* now it's safe to free the pages */
 		atomic_long_sub(rb->aux_nr_pages - rb->aux_mmap_locked, &mmap_user->locked_vm);
-		atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm);
+		if (rb->aux_mmap_mm) {
+			atomic64_sub(rb->aux_mmap_locked, &rb->aux_mmap_mm->pinned_vm);
+			mmdrop(rb->aux_mmap_mm);
+			rb->aux_mmap_mm = NULL;
+		}
 
 		/* this has to be the last one */
 		rb_free_aux(rb);
@@ -7272,7 +7276,7 @@ static void perf_mmap_unaccount(struct vm_area_struct *vma, struct perf_buffer *
 
 	atomic_long_sub((perf_data_size(rb) >> PAGE_SHIFT) + 1 - rb->mmap_locked,
 			&user->locked_vm);
-	atomic64_sub(rb->mmap_locked, &vma->vm_mm->pinned_vm);
+	atomic64_sub(rb->mmap_locked, &rb->mmap_mm->pinned_vm);
 }
 
 static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
@@ -7311,7 +7315,6 @@ static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
 			 * Success -- managed to mmap() the same buffer
 			 * multiple times.
 			 */
-			perf_mmap_account(vma, user_extra, extra);
 			refcount_inc(&event->mmap_count);
 			return 0;
 		}
@@ -7338,6 +7341,8 @@ static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
 		return -ENOMEM;
 
 	rb->mmap_locked = extra;
+	rb->mmap_mm = vma->vm_mm;
+	mmgrab(rb->mmap_mm);
 
 	ring_buffer_attach(event, rb);
 
@@ -7399,7 +7404,8 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 	if (rb_has_aux(rb)) {
 		refcount_inc(&rb->aux_mmap_count);
-
+		user_extra = 0;
+		extra = 0;
 	} else {
 		if (!perf_mmap_calc_limits(vma, &user_extra, &extra)) {
 			refcount_dec(&rb->mmap_count);
@@ -7420,6 +7426,8 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 		refcount_set(&rb->aux_mmap_count, 1);
 		rb->aux_mmap_locked = extra;
+		rb->aux_mmap_mm = vma->vm_mm;
+		mmgrab(rb->aux_mmap_mm);
 	}
 
 	perf_mmap_account(vma, user_extra, extra);
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index c03c4f2eea57..f10eacd8b590 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
@@ -5,6 +5,7 @@
 #include <linux/hardirq.h>
 #include <linux/uaccess.h>
 #include <linux/refcount.h>
+#include <linux/sched/mm.h>
 
 /* Buffer handling */
 
@@ -38,6 +39,8 @@ struct perf_buffer {
 	refcount_t			mmap_count;
 	unsigned long			mmap_locked;
 	struct user_struct		*mmap_user;
+	struct mm_struct		*mmap_mm;
+	struct mm_struct		*aux_mmap_mm;
 
 	/* AUX area */
 	struct mutex			aux_mutex;
@@ -67,6 +70,10 @@ static inline void rb_free_rcu(struct rcu_head *rcu_head)
 	struct perf_buffer *rb;
 
 	rb = container_of(rcu_head, struct perf_buffer, rcu_head);
+	if (rb->aux_mmap_mm)
+		mmdrop(rb->aux_mmap_mm);
+	if (rb->mmap_mm)
+		mmdrop(rb->mmap_mm);
 	free_uid(rb->mmap_user);
 	rb_free(rb);
 }

[PATCH v2] perf/core: fix user->locked_vm leak on secondary mmap()

[Hui Peng]

Commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
`user_extra = nr_pages` ahead of the existing-buffer checks (`if
(event->rb)` and `if (rb_has_aux(rb))`), and subsequently
commit 5d299897f1e3 ("perf: Split out the RB allocation") and
commit 2aee37682391 ("perf: Split out the AUX buffer allocation")
carried `long extra = 0, user_extra = nr_pages` into perf_mmap_rb() and
perf_mmap_aux().

As a result, when an already-allocated ring buffer (`event->rb`) or AUX
buffer (`rb_has_aux(rb)`) is mapped again via mmap(), perf_mmap_account()
is called with `user_extra = nr_pages` instead of `0`, charging `nr_pages`
to `current_user()->locked_vm` on every additional mapping. However,
perf_mmap_unaccount() and perf_mmap_close() only subtract the ring buffer's
and AUX buffer's pages once when the final `rb->mmap_count` /
`rb->aux_mmap_count` reference drops to zero. Consequently, every secondary
mmap() + munmap() cycle on a perf event permanently leaks `nr_pages` in
`user->locked_vm`, eventually exhausting `perf_event_mlock_kb` and
`RLIMIT_MEMLOCK` (-EPERM) for that user.

Fix this by only calling perf_mmap_account() when allocating a new ring
buffer in perf_mmap_rb() or a new AUX buffer in perf_mmap_aux().

Tested in QEMU against Linux 7.3.0-rc3 with a standalone C reproducer
running as an unprivileged user (UID 1000, RLIMIT_MEMLOCK=0,
perf_event_paranoid=1) that opens a software perf event, maps a 65-page
ring buffer, performs 10 secondary mmap() + munmap() cycles on the same
event fd, and then unmaps and closes the event. On the unfixed kernel,
subsequent perf_mmap() calls by UID 1000 permanently fail with -EPERM due
to the leaked `user->locked_vm` (650 pages leaked), whereas with the fix
applied `user->locked_vm` returns to 0 and subsequent perf_mmap() calls
succeed.

Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Dropped the cross-MM `pinned_vm` / `rb->mmap_mm` (`mmgrab`/`mmdrop`)
  changes (which caused an RCU softirq context violation in `rb_free_rcu()`
  in v1, flagged by sashiko-bot) to keep this patch focused on the
  `user->locked_vm` leak on secondary `mmap()`.
- Updated the `Fixes:` tag to `0c8a4e4139ad ("perf/core: Further simplify
  perf_mmap()")` and added QEMU reproducer test details to the commit
  message.

 kernel/events/core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index fe33fe15689d..8fc15239bd7e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7311,7 +7311,6 @@ static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
 			 * Success -- managed to mmap() the same buffer
 			 * multiple times.
 			 */
-			perf_mmap_account(vma, user_extra, extra);
 			refcount_inc(&event->mmap_count);
 			return 0;
 		}
@@ -7399,7 +7398,6 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 	if (rb_has_aux(rb)) {
 		refcount_inc(&rb->aux_mmap_count);
-
 	} else {
 		if (!perf_mmap_calc_limits(vma, &user_extra, &extra)) {
 			refcount_dec(&rb->mmap_count);
@@ -7420,9 +7418,9 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 		refcount_set(&rb->aux_mmap_count, 1);
 		rb->aux_mmap_locked = extra;
+		perf_mmap_account(vma, user_extra, extra);
 	}
 
-	perf_mmap_account(vma, user_extra, extra);
 	refcount_inc(&event->mmap_count);
 
 	return 0;
-- 
2.47.3

Re: [PATCH v2] perf/core: fix user->locked_vm leak on secondary mmap()

[krzk]

On Mon, 21 Sep 2026 00:33:06 +0000, Hui Peng wrote:
> Commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
> `user_extra = nr_pages` ahead of the existing-buffer checks (`if
> (event->rb)` and `if (rb_has_aux(rb))`), and subsequently
> commit 5d299897f1e3 ("perf: Split out the RB allocation") and
> commit 2aee37682391 ("perf: Split out the AUX buffer allocation")
> carried `long extra = 0, user_extra = nr_pages` into perf_mmap_rb() and
> perf_mmap_aux().
> 
> As a result, when an already-allocated ring buffer (`event->rb`) or AUX
> buffer (`rb_has_aux(rb)`) is mapped again via mmap(), perf_mmap_account()
> is called with `user_extra = nr_pages` instead of `0`, charging `nr_pages`
> to `current_user()->locked_vm` on every additional mapping. However,
> perf_mmap_unaccount() and perf_mmap_close() only subtract the ring buffer's
> and AUX buffer's pages once when the final `rb->mmap_count` /
> `rb->aux_mmap_count` reference drops to zero. Consequently, every secondary
> mmap() + munmap() cycle on a perf event permanently leaks `nr_pages` in
> `user->locked_vm`, eventually exhausting `perf_event_mlock_kb` and
> `RLIMIT_MEMLOCK` (-EPERM) for that user.
> 
> Fix this by only calling perf_mmap_account() when allocating a new ring
> buffer in perf_mmap_rb() or a new AUX buffer in perf_mmap_aux().
> 
> Tested in QEMU against Linux 7.3.0-rc3 with a standalone C reproducer
> running as an unprivileged user (UID 1000, RLIMIT_MEMLOCK=0,
> perf_event_paranoid=1) that opens a software perf event, maps a 65-page
> ring buffer, performs 10 secondary mmap() + munmap() cycles on the same
> event fd, and then unmaps and closes the event. On the unfixed kernel,
> subsequent perf_mmap() calls by UID 1000 permanently fail with -EPERM due
> to the leaked `user->locked_vm` (650 pages leaked), whereas with the fix
> applied `user->locked_vm` returns to 0 and subsequent perf_mmap() calls
> succeed.
> 
> Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Dropped the cross-MM `pinned_vm` / `rb->mmap_mm` (`mmgrab`/`mmdrop`)
>   changes (which caused an RCU softirq context violation in `rb_free_rcu()`
>   in v1, flagged by sashiko-bot) to keep this patch focused on the
>   `user->locked_vm` leak on secondary `mmap()`.
> - Updated the `Fixes:` tag to `0c8a4e4139ad ("perf/core: Further simplify
>   perf_mmap()")` and added QEMU reproducer test details to the commit
>   message.
> 
>  kernel/events/core.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof

Re: [PATCH v2] perf/core: fix user->locked_vm leak on secondary mmap()

[krzk]

On Mon, 21 Sep 2026 00:33:06 +0000, Hui Peng wrote:
> Commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
> `user_extra = nr_pages` ahead of the existing-buffer checks (`if
> (event->rb)` and `if (rb_has_aux(rb))`), and subsequently
> commit 5d299897f1e3 ("perf: Split out the RB allocation") and
> commit 2aee37682391 ("perf: Split out the AUX buffer allocation")
> carried `long extra = 0, user_extra = nr_pages` into perf_mmap_rb() and
> perf_mmap_aux().
> 
> As a result, when an already-allocated ring buffer (`event->rb`) or AUX
> buffer (`rb_has_aux(rb)`) is mapped again via mmap(), perf_mmap_account()
> is called with `user_extra = nr_pages` instead of `0`, charging `nr_pages`
> to `current_user()->locked_vm` on every additional mapping. However,
> perf_mmap_unaccount() and perf_mmap_close() only subtract the ring buffer's
> and AUX buffer's pages once when the final `rb->mmap_count` /
> `rb->aux_mmap_count` reference drops to zero. Consequently, every secondary
> mmap() + munmap() cycle on a perf event permanently leaks `nr_pages` in
> `user->locked_vm`, eventually exhausting `perf_event_mlock_kb` and
> `RLIMIT_MEMLOCK` (-EPERM) for that user.
> 
> Fix this by only calling perf_mmap_account() when allocating a new ring
> buffer in perf_mmap_rb() or a new AUX buffer in perf_mmap_aux().
> 
> Tested in QEMU against Linux 7.3.0-rc3 with a standalone C reproducer
> running as an unprivileged user (UID 1000, RLIMIT_MEMLOCK=0,
> perf_event_paranoid=1) that opens a software perf event, maps a 65-page
> ring buffer, performs 10 secondary mmap() + munmap() cycles on the same
> event fd, and then unmaps and closes the event. On the unfixed kernel,
> subsequent perf_mmap() calls by UID 1000 permanently fail with -EPERM due
> to the leaked `user->locked_vm` (650 pages leaked), whereas with the fix
> applied `user->locked_vm` returns to 0 and subsequent perf_mmap() calls
> succeed.
> 
> Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Dropped the cross-MM `pinned_vm` / `rb->mmap_mm` (`mmgrab`/`mmdrop`)
>   changes (which caused an RCU softirq context violation in `rb_free_rcu()`
>   in v1, flagged by sashiko-bot) to keep this patch focused on the
>   `user->locked_vm` leak on secondary `mmap()`.
> - Updated the `Fixes:` tag to `0c8a4e4139ad ("perf/core: Further simplify
>   perf_mmap()")` and added QEMU reproducer test details to the commit
>   message.
> 
>  kernel/events/core.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof