Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18563 -------------------------------- perf_event_set_output() can succeed and add the event to a ring buffer's event_list, making it visible to concurrent perf_mmap_close(). The latter raises the event refcount via atomic_long_inc_not_zero() during its RCU-protected iteration of rb->event_list. If a subsequent check in sys_perf_event_open() fails, the error path calls free_event() which expects refcount==1. When perf_mmap_close() has already incremented it to 2, free_event() triggers a WARN. Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") Signed-off-by: Luo Gengkun <luogengkun2@huawei.com> --- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index ff875ddf4aeb..292419dc2ec5 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11149,7 +11149,7 @@ SYSCALL_DEFINE5(perf_event_open, * and that will take care of freeing the event. */ if (!event_file) - free_event(event); + put_event(event); err_cred: if (task) mutex_unlock(&task->signal->cred_guard_mutex); -- 2.34.1