From: Thomas Gleixner <tglx@linutronix.de> mainline inclusion from mainline-v6.17-rc1 commit 5468c0fbccbb9d156522c50832244a8b722374fb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICULKF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Failure of the AUX buffer allocation leaks the reference count. Set the reference count to 1 only when the allocation succeeds. Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Cc: stable@vger.kernel.org Conflicts: kernel/events/core.c [Two cleanup patch (0c8a4e4139 and 954878377) did not backport, causing conflicts] Signed-off-by: Tengda Wu <wutengda2@huawei.com> --- kernel/events/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index e1125d158c74..4b9c5050ede2 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6138,7 +6138,6 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) goto unlock; } - atomic_set(&rb->aux_mmap_count, 1); user_extra = nr_pages; goto accounting; @@ -6243,8 +6242,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) } else { ret = rb_alloc_aux(rb, event, vma->vm_pgoff, nr_pages, event->attr.aux_watermark, flags); - if (!ret) + if (!ret) { + atomic_set(&rb->aux_mmap_count, 1); rb->aux_mmap_locked = extra; + } } unlock: @@ -6254,6 +6255,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) atomic_inc(&event->mmap_count); } else if (rb) { + /* AUX allocation failed */ atomic_dec(&rb->mmap_count); } aux_unlock: -- 2.34.1