[PATCH 2/2] perf/core: handle first AUX mmap on redirected events

[Joshua Warren]

A redirected event (perf_event_set_output()) enters perf_mmap_aux()
with mmap_count == 0: its first mmap() can only be the AUX mmap, since
perf_mmap_rb() rejects count-0 events with -EBUSY.  The ring-side fix
is commit d06bf78e55d5 ("perf: Fix refcount warning on
event->mmap_count increment").  The
tail refcount_inc() from zero saturates the count and reports
REFCOUNT_ADD_UAF, which refcount_warn_saturate() raises through
REFCOUNT_CORRUPTION(): a WARN_ONCE() normally, but a BUG() when
CONFIG_BUG_ON_DATA_CORRUPTION=y.  A saturated count is never released:
a later AUX mmap() of the event adds to the saturated count and reports
REFCOUNT_ADD_OVF (a WARN_ONCE(), silent after its first report), while
perf_mmap_close() takes the saturated count silently --
refcount_dec_and_mutex_lock() fails without warning -- so the close
path that detaches the event from the borrowed rb can never run.

Reject the AUX mmap() of a not-yet-mmaped event with -EBUSY, matching
the ring mmap() stance: the redirect keeps the state
perf_event_set_output() left it in, and the shared rb's counters and
its user and mm accounting stay untouched.  As on the ring side, the
reject avoids creating a mapping that aliases the borrowed rb, so the
shared user_page and AUX area remain the owner's alone.

This changes observable behavior: the first AUX mmap() of a redirected
event now fails with -EBUSY where it previously reported a refcount
error and saturated the event's mmap_count.  Only flows that are already
broken on this base are affected: a redirected event's ring mmap() is
rejected with -EBUSY already, so its AUX mmap() could only ever report
that error and saturate.

The impact of the defect is availability only: the count saturates
fail-safe, and no use-after-free was found.  The defect is reachable by
an unprivileged user through perf_event_set_output() (PERF_FLAG_FD_OUTPUT)
on AUX-capable PMUs where userspace can create the AUX-owning event.  On
a default kernel the first such mmap() prints one warning.  With
panic_on_warn=1 that first warning panics the kernel, and with
CONFIG_BUG_ON_DATA_CORRUPTION=y the BUG() oopses the task regardless of
panic_on_warn.

Tested with a source-level host harness that compiles perf_mmap,
perf_mmap_rb, perf_mmap_aux, perf_mmap_close,
perf_mmap_account/unaccount/calc_limits straight from this tree and
drives full ring, AUX and redirected-event lifecycles over them
(single-user, single-mm, single-threaded; nothing runs in a kernel):
the previous commit's source fails the nine redirected-AUX scenarios
(the AUX mmap of a redirected event saturates mmap_count), this source
passes all 33, and the 22-case alias-charge harness still passes.
The harness is tooling, not part of this change.  Compile-verified with a
focused x86-64 defconfig build of kernel/events/core.o; the kernel was
not booted and no runtime kernel reproduction was performed.

AI coding agents in the omp harness wrote the patches, the reproducer
and the measurements.

Fixes: 448f97fba901 ("perf: Convert mmap() refcounts to refcount_t")
Signed-off-by: Joshua Warren <joshua.s.warren@xxxxxxxxx>
---
 kernel/events/core.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index c8bb805bc..d336e5747 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7419,6 +7419,17 @@ static int perf_mmap_aux(struct vm_area_struct
*vma, struct perf_event *event,
 	if (!is_power_of_2(nr_pages))
 		return -EINVAL;

+	/*
+	 * A redirected event (perf_event_set_output()) arrives here with
+	 * mmap_count == 0; perf_mmap_rb() rejects its ring mmap() with
+	 * -EBUSY.  Reject its AUX mmap() the same way: the tail
+	 * refcount_inc() below would raise mmap_count from zero, which
+	 * WARNs and saturates the count, and a saturated count cannot be
+	 * released by perf_mmap_close().
+	 */
+	if (!refcount_read(&event->mmap_count))
+		return -EBUSY;
+
 	if (!refcount_inc_not_zero(&rb->mmap_count))
 		return -EINVAL;

-- 
2.39.5