[PATCH] perf/core: fix locked_vm leak on alias mmap() and cross-MM pinned_vm underflow

[PATCH] perf/core: fix locked_vm leak on alias mmap() and cross-MM pinned_vm underflow

[Hui Peng]

In perf_mmap(), mapping an output ring buffer onto an event via
PERF_EVENT_IOC_SET_OUTPUT / alias mmap() increments user->locked_vm and
mm->pinned_vm without recording the accounting MM on the ring_buffer or
releasing user_extra onperf_mmap_close(), causing a permanent locked_vm
leak and a cross-MM pinned_vm underflow when the mapping is closed in a
different process. Store the accounted mm_struct on struct perf_buffer
and unaccount against the original mm_struct on close.

Fixes: fae85b7c8bcc ("perf: Start the restructuring")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/kernel/events/core.c b/kernel/events/core.c
index fe33fe15689d..2be9301dcd7c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7050,7 +7050,11 @@ static void perf_mmap_close(struct vm_area_struct *vma)
 
 		/* now it's safe to free the pages */
 		atomic_long_sub(rb->aux_nr_pages - rb->aux_mmap_locked, &mmap_user->locked_vm);
-		atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm);
+		if (rb->aux_mmap_mm) {
+			atomic64_sub(rb->aux_mmap_locked, &rb->aux_mmap_mm->pinned_vm);
+			mmdrop(rb->aux_mmap_mm);
+			rb->aux_mmap_mm = NULL;
+		}
 
 		/* this has to be the last one */
 		rb_free_aux(rb);
@@ -7272,7 +7276,7 @@ static void perf_mmap_unaccount(struct vm_area_struct *vma, struct perf_buffer *
 
 	atomic_long_sub((perf_data_size(rb) >> PAGE_SHIFT) + 1 - rb->mmap_locked,
 			&user->locked_vm);
-	atomic64_sub(rb->mmap_locked, &vma->vm_mm->pinned_vm);
+	atomic64_sub(rb->mmap_locked, &rb->mmap_mm->pinned_vm);
 }
 
 static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
@@ -7311,7 +7315,6 @@ static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
 			 * Success -- managed to mmap() the same buffer
 			 * multiple times.
 			 */
-			perf_mmap_account(vma, user_extra, extra);
 			refcount_inc(&event->mmap_count);
 			return 0;
 		}
@@ -7338,6 +7341,8 @@ static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
 		return -ENOMEM;
 
 	rb->mmap_locked = extra;
+	rb->mmap_mm = vma->vm_mm;
+	mmgrab(rb->mmap_mm);
 
 	ring_buffer_attach(event, rb);
 
@@ -7399,7 +7404,8 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 	if (rb_has_aux(rb)) {
 		refcount_inc(&rb->aux_mmap_count);
-
+		user_extra = 0;
+		extra = 0;
 	} else {
 		if (!perf_mmap_calc_limits(vma, &user_extra, &extra)) {
 			refcount_dec(&rb->mmap_count);
@@ -7420,6 +7426,8 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 		refcount_set(&rb->aux_mmap_count, 1);
 		rb->aux_mmap_locked = extra;
+		rb->aux_mmap_mm = vma->vm_mm;
+		mmgrab(rb->aux_mmap_mm);
 	}
 
 	perf_mmap_account(vma, user_extra, extra);
diff --git a/kernel/events/internal.h b/kernel/events/internal.h
index c03c4f2eea57..f10eacd8b590 100644
--- a/kernel/events/internal.h
+++ b/kernel/events/internal.h
@@ -5,6 +5,7 @@
 #include <linux/hardirq.h>
 #include <linux/uaccess.h>
 #include <linux/refcount.h>
+#include <linux/sched/mm.h>
 
 /* Buffer handling */
 
@@ -38,6 +39,8 @@ struct perf_buffer {
 	refcount_t			mmap_count;
 	unsigned long			mmap_locked;
 	struct user_struct		*mmap_user;
+	struct mm_struct		*mmap_mm;
+	struct mm_struct		*aux_mmap_mm;
 
 	/* AUX area */
 	struct mutex			aux_mutex;
@@ -67,6 +70,10 @@ static inline void rb_free_rcu(struct rcu_head *rcu_head)
 	struct perf_buffer *rb;
 
 	rb = container_of(rcu_head, struct perf_buffer, rcu_head);
+	if (rb->aux_mmap_mm)
+		mmdrop(rb->aux_mmap_mm);
+	if (rb->mmap_mm)
+		mmdrop(rb->mmap_mm);
 	free_uid(rb->mmap_user);
 	rb_free(rb);
 }

Re: [PATCH] perf/core: fix locked_vm leak on alias mmap() and cross-MM pinned_vm underflow

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] perf: mmdrop() in RCU callback causes softirq context violation
--

commit f66e9c8b5f2a9c636e7dc5afd975c9e2ed17cf78
Author: Hui Peng <benquike@gmail.com>

perf/core: fix locked_vm leak on alias mmap() and cross-MM pinned_vm underflow

In perf_mmap(), mapping an output ring buffer onto an event via
PERF_EVENT_IOC_SET_OUTPUT / alias mmap() increments user->locked_vm and
mm->pinned_vm without recording the accounting MM on the ring_buffer or
releasing user_extra onperf_mmap_close(), causing a permanent locked_vm
leak and a cross-MM pinned_vm underflow when the mapping is closed in a
different process. Store the accounted mm_struct on struct perf_buffer
and unaccount against the original mm_struct on close.

> diff --git a/kernel/events/internal.h b/kernel/events/internal.h
> index c03c4f2eea571..f10eacd8b5903 100644
> --- a/kernel/events/internal.h
> +++ b/kernel/events/internal.h
[ ... ]
> @@ -67,6 +70,10 @@ static inline void rb_free_rcu(struct rcu_head *rcu_head)
>  	struct perf_buffer *rb;
>  
>  	rb = container_of(rcu_head, struct perf_buffer, rcu_head);
> +	if (rb->aux_mmap_mm)
> +		mmdrop(rb->aux_mmap_mm);
> +	if (rb->mmap_mm)
> +		mmdrop(rb->mmap_mm);

[Severity: High]
Does this code call mmdrop() in an RCU callback, which executes in a softirq
context?

If this mmdrop() drops the final mm_count reference (for instance, if the
original process has already exited), it synchronously invokes __mmdrop().
__mmdrop() performs blocking teardown operations (such as pgd_free() and
percpu_counter_destroy()) which can sleep.

Sleeping in a softirq context is illegal and leads to a kernel BUG or panic.

This could happen if a process mmaps a perf event to create a ring buffer,
which uses mmgrab() to increment mm_count. If the process then exits, dropping
its own mm reference, and later the ring buffer is unmapped (e.g., by another
process closing the alias), this triggers ring_buffer_put(), which schedules
rb_free_rcu() via call_rcu(). The RCU callback then drops the final reference
and triggers the bug.

Should this teardown be deferred to the workqueue (rb_free_work) which runs
in a process context, or perhaps use mmdrop_async() instead?

>  	free_uid(rb->mmap_user);
>  	rb_free(rb);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919221728.3707189-1-benquike@gmail.com?part=1

[PATCH v2] perf/core: fix user->locked_vm leak on secondary mmap()

[Hui Peng]

Commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
`user_extra = nr_pages` ahead of the existing-buffer checks (`if
(event->rb)` and `if (rb_has_aux(rb))`), and subsequently
commit 5d299897f1e3 ("perf: Split out the RB allocation") and
commit 2aee37682391 ("perf: Split out the AUX buffer allocation")
carried `long extra = 0, user_extra = nr_pages` into perf_mmap_rb() and
perf_mmap_aux().

As a result, when an already-allocated ring buffer (`event->rb`) or AUX
buffer (`rb_has_aux(rb)`) is mapped again via mmap(), perf_mmap_account()
is called with `user_extra = nr_pages` instead of `0`, charging `nr_pages`
to `current_user()->locked_vm` on every additional mapping. However,
perf_mmap_unaccount() and perf_mmap_close() only subtract the ring buffer's
and AUX buffer's pages once when the final `rb->mmap_count` /
`rb->aux_mmap_count` reference drops to zero. Consequently, every secondary
mmap() + munmap() cycle on a perf event permanently leaks `nr_pages` in
`user->locked_vm`, eventually exhausting `perf_event_mlock_kb` and
`RLIMIT_MEMLOCK` (-EPERM) for that user.

Fix this by only calling perf_mmap_account() when allocating a new ring
buffer in perf_mmap_rb() or a new AUX buffer in perf_mmap_aux().

Tested in QEMU against Linux 7.3.0-rc3 with a standalone C reproducer
running as an unprivileged user (UID 1000, RLIMIT_MEMLOCK=0,
perf_event_paranoid=1) that opens a software perf event, maps a 65-page
ring buffer, performs 10 secondary mmap() + munmap() cycles on the same
event fd, and then unmaps and closes the event. On the unfixed kernel,
subsequent perf_mmap() calls by UID 1000 permanently fail with -EPERM due
to the leaked `user->locked_vm` (650 pages leaked), whereas with the fix
applied `user->locked_vm` returns to 0 and subsequent perf_mmap() calls
succeed.

Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Dropped the cross-MM `pinned_vm` / `rb->mmap_mm` (`mmgrab`/`mmdrop`)
  changes (which caused an RCU softirq context violation in `rb_free_rcu()`
  in v1, flagged by sashiko-bot) to keep this patch focused on the
  `user->locked_vm` leak on secondary `mmap()`.
- Updated the `Fixes:` tag to `0c8a4e4139ad ("perf/core: Further simplify
  perf_mmap()")` and added QEMU reproducer test details to the commit
  message.

 kernel/events/core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index fe33fe15689d..8fc15239bd7e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7311,7 +7311,6 @@ static int perf_mmap_rb(struct vm_area_struct *vma, struct perf_event *event,
 			 * Success -- managed to mmap() the same buffer
 			 * multiple times.
 			 */
-			perf_mmap_account(vma, user_extra, extra);
 			refcount_inc(&event->mmap_count);
 			return 0;
 		}
@@ -7399,7 +7398,6 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 	if (rb_has_aux(rb)) {
 		refcount_inc(&rb->aux_mmap_count);
-
 	} else {
 		if (!perf_mmap_calc_limits(vma, &user_extra, &extra)) {
 			refcount_dec(&rb->mmap_count);
@@ -7420,9 +7418,9 @@ static int perf_mmap_aux(struct vm_area_struct *vma, struct perf_event *event,
 
 		refcount_set(&rb->aux_mmap_count, 1);
 		rb->aux_mmap_locked = extra;
+		perf_mmap_account(vma, user_extra, extra);
 	}
 
-	perf_mmap_account(vma, user_extra, extra);
 	refcount_inc(&event->mmap_count);
 
 	return 0;
-- 
2.47.3

Re: [PATCH v2] perf/core: fix user->locked_vm leak on secondary mmap()

[sashiko-bot]

> Commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
> `user_extra = nr_pages` ahead of the existing-buffer checks (`if
> (event->rb)` and `if (rb_has_aux(rb))`), and subsequently
> commit 5d299897f1e3 ("perf: Split out the RB allocation") and
> commit 2aee37682391 ("perf: Split out the AUX buffer allocation")
> carried `long extra = 0, user_extra = nr_pages` into perf_mmap_rb() and
> perf_mmap_aux().
> 
> As a result, when an already-allocated ring buffer (`event->rb`) or AUX
> buffer (`rb_has_aux(rb)`) is mapped again via mmap(), perf_mmap_account()
> is called with `user_extra = nr_pages` instead of `0`, charging `nr_pages`
> to `current_user()->locked_vm` on every additional mapping. However,
> perf_mmap_unaccount() and perf_mmap_close() only subtract the ring buffer's
> and AUX buffer's pages once when the final `rb->mmap_count` /
> `rb->aux_mmap_count` reference drops to zero. Consequently, every secondary
> [ ... ]
> 
> Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921003306.426050-1-benquike@gmail.com?part=1

Re: [PATCH v2] perf/core: fix user->locked_vm leak on secondary mmap()

[krzk]

On Mon, 21 Sep 2026 00:33:06 +0000, Hui Peng wrote:
> Commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
> `user_extra = nr_pages` ahead of the existing-buffer checks (`if
> (event->rb)` and `if (rb_has_aux(rb))`), and subsequently
> commit 5d299897f1e3 ("perf: Split out the RB allocation") and
> commit 2aee37682391 ("perf: Split out the AUX buffer allocation")
> carried `long extra = 0, user_extra = nr_pages` into perf_mmap_rb() and
> perf_mmap_aux().
> 
> As a result, when an already-allocated ring buffer (`event->rb`) or AUX
> buffer (`rb_has_aux(rb)`) is mapped again via mmap(), perf_mmap_account()
> is called with `user_extra = nr_pages` instead of `0`, charging `nr_pages`
> to `current_user()->locked_vm` on every additional mapping. However,
> perf_mmap_unaccount() and perf_mmap_close() only subtract the ring buffer's
> and AUX buffer's pages once when the final `rb->mmap_count` /
> `rb->aux_mmap_count` reference drops to zero. Consequently, every secondary
> mmap() + munmap() cycle on a perf event permanently leaks `nr_pages` in
> `user->locked_vm`, eventually exhausting `perf_event_mlock_kb` and
> `RLIMIT_MEMLOCK` (-EPERM) for that user.
> 
> Fix this by only calling perf_mmap_account() when allocating a new ring
> buffer in perf_mmap_rb() or a new AUX buffer in perf_mmap_aux().
> 
> Tested in QEMU against Linux 7.3.0-rc3 with a standalone C reproducer
> running as an unprivileged user (UID 1000, RLIMIT_MEMLOCK=0,
> perf_event_paranoid=1) that opens a software perf event, maps a 65-page
> ring buffer, performs 10 secondary mmap() + munmap() cycles on the same
> event fd, and then unmaps and closes the event. On the unfixed kernel,
> subsequent perf_mmap() calls by UID 1000 permanently fail with -EPERM due
> to the leaked `user->locked_vm` (650 pages leaked), whereas with the fix
> applied `user->locked_vm` returns to 0 and subsequent perf_mmap() calls
> succeed.
> 
> Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Dropped the cross-MM `pinned_vm` / `rb->mmap_mm` (`mmgrab`/`mmdrop`)
>   changes (which caused an RCU softirq context violation in `rb_free_rcu()`
>   in v1, flagged by sashiko-bot) to keep this patch focused on the
>   `user->locked_vm` leak on secondary `mmap()`.
> - Updated the `Fixes:` tag to `0c8a4e4139ad ("perf/core: Further simplify
>   perf_mmap()")` and added QEMU reproducer test details to the commit
>   message.
> 
>  kernel/events/core.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof

Re: [PATCH v2] perf/core: fix user->locked_vm leak on secondary mmap()

[krzk]

On Mon, 21 Sep 2026 00:33:06 +0000, Hui Peng wrote:
> Commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
> `user_extra = nr_pages` ahead of the existing-buffer checks (`if
> (event->rb)` and `if (rb_has_aux(rb))`), and subsequently
> commit 5d299897f1e3 ("perf: Split out the RB allocation") and
> commit 2aee37682391 ("perf: Split out the AUX buffer allocation")
> carried `long extra = 0, user_extra = nr_pages` into perf_mmap_rb() and
> perf_mmap_aux().
> 
> As a result, when an already-allocated ring buffer (`event->rb`) or AUX
> buffer (`rb_has_aux(rb)`) is mapped again via mmap(), perf_mmap_account()
> is called with `user_extra = nr_pages` instead of `0`, charging `nr_pages`
> to `current_user()->locked_vm` on every additional mapping. However,
> perf_mmap_unaccount() and perf_mmap_close() only subtract the ring buffer's
> and AUX buffer's pages once when the final `rb->mmap_count` /
> `rb->aux_mmap_count` reference drops to zero. Consequently, every secondary
> mmap() + munmap() cycle on a perf event permanently leaks `nr_pages` in
> `user->locked_vm`, eventually exhausting `perf_event_mlock_kb` and
> `RLIMIT_MEMLOCK` (-EPERM) for that user.
> 
> Fix this by only calling perf_mmap_account() when allocating a new ring
> buffer in perf_mmap_rb() or a new AUX buffer in perf_mmap_aux().
> 
> Tested in QEMU against Linux 7.3.0-rc3 with a standalone C reproducer
> running as an unprivileged user (UID 1000, RLIMIT_MEMLOCK=0,
> perf_event_paranoid=1) that opens a software perf event, maps a 65-page
> ring buffer, performs 10 secondary mmap() + munmap() cycles on the same
> event fd, and then unmaps and closes the event. On the unfixed kernel,
> subsequent perf_mmap() calls by UID 1000 permanently fail with -EPERM due
> to the leaked `user->locked_vm` (650 pages leaked), whereas with the fix
> applied `user->locked_vm` returns to 0 and subsequent perf_mmap() calls
> succeed.
> 
> Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Dropped the cross-MM `pinned_vm` / `rb->mmap_mm` (`mmgrab`/`mmdrop`)
>   changes (which caused an RCU softirq context violation in `rb_free_rcu()`
>   in v1, flagged by sashiko-bot) to keep this patch focused on the
>   `user->locked_vm` leak on secondary `mmap()`.
> - Updated the `Fixes:` tag to `0c8a4e4139ad ("perf/core: Further simplify
>   perf_mmap()")` and added QEMU reproducer test details to the commit
>   message.
> 
>  kernel/events/core.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof