[PATCH 1/2] perf/core: Avoid charging mmap aliases twice

[Joshua Warren]

commit 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()") hoisted
user_extra = nr_pages above the rb and AUX branches of perf_mmap().
Before that change the alias paths (mmap() of an already-mapped ring
buffer or AUX area) reached the single charge site with user_extra = 0
and extra = 0.  After the hoist they carry the buffer's page count, so
every alias mmap() charges the perf mlock gift (user->perf_mlock) again,
through perf_mmap_account().  extra remains 0 on the alias paths, so
mm->pinned_vm is neither charged nor leaked by an alias -- the duplicate
charge is confined to user->perf_mlock.

The excess is never removed: the final close uncharges exactly the
first allocation's charge (perf_mmap_unaccount() for the ring buffer,
the AUX close path for AUX), so the per-alias charges stay on
user->perf_mlock.  Alias paths also charge without passing
perf_mmap_calc_limits(), and an alias mmap() that fails in map_range()
is torn down via perf_mmap_close(), which does not release the alias
charge either.

The inflated counter throttles later mmaps: perf_mmap_calc_limits()
clamps the recorded user->perf_mlock at the perf-event mlock budget
(sysctl_perf_event_mlock scaled by online CPUs) before adding a fresh
allocation's user_extra, so once the counter is inflated past the
budget, every fresh allocation spills its whole size out of the perf
mlock gift into mm->pinned_vm and is tested against RLIMIT_MEMLOCK
there, and can be denied with -EPERM even though the real usage fits
the budget.

Charge on first allocation only: drop the ring buffer alias-branch
charge and move the AUX charge from the common tail into the AUX
first-allocation branch.  Aliases share the existing charge and the
final close releases it exactly once, as before.

Tested with a host-level regression harness that compiles the
accounting code straight from this tree (perf_mmap, perf_mmap_rb,
perf_mmap_aux, perf_mmap_close, perf_mmap_account/unaccount/calc_limits
and the internal.h helpers) and drives full ring and AUX lifecycles
over it (single-user, single-mm, single-threaded; nothing runs in a
kernel): the unfixed tree leaves nonzero user->perf_mlock behind on
alias and failed-alias lifecycles, the fixed tree balances all 22.
The harness is tooling, not part of this change.  Compile-verified with a
focused x86-64 defconfig build of kernel/events/core.o; the kernel was
not booted and no runtime kernel reproduction was performed.

AI coding agents in the omp harness wrote the patches, the reproducer
and the measurements.

Fixes: 0c8a4e4139ad ("perf/core: Further simplify perf_mmap()")
Signed-off-by: Joshua Warren <joshua.s.warren@xxxxxxxxx>
---
 kernel/events/core.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 457d75ea7..c8bb805bc 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7332,9 +7332,11 @@ static int perf_mmap_rb(struct vm_area_struct
*vma, struct perf_event *event,
 		if (refcount_inc_not_zero(&event->rb->mmap_count)) {
 			/*
 			 * Success -- managed to mmap() the same buffer
-			 * multiple times.
+			 * multiple times. The alias shares the ring's
+			 * already-locked pages; the existing charge stays
+			 * as-is and is removed once, when the last mapping
+			 * closes.
 			 */
-			perf_mmap_account(vma, user_extra, extra);
 			refcount_inc(&event->mmap_count);
 			return 0;
 		}
@@ -7443,9 +7445,16 @@ static int perf_mmap_aux(struct vm_area_struct
*vma, struct perf_event *event,

 		refcount_set(&rb->aux_mmap_count, 1);
 		rb->aux_mmap_locked = extra;
+
+		/*
+		 * Charge the AUX area once, at first allocation. The alias
+		 * branch above shares the already-locked pages and adds no
+		 * charge; the single charge is removed when the last AUX
+		 * mapping closes.
+		 */
+		perf_mmap_account(vma, user_extra, extra);
 	}

-	perf_mmap_account(vma, user_extra, extra);
 	refcount_inc(&event->mmap_count);

 	return 0;
-- 
2.39.5