Description

In the Linux kernel, the following vulnerability has been resolved: perf/core: Handle buffer mapping fail correctly in perf_mmap() After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set up page table entries are zapped, but the other perf specific side effects of that failure are not handled. The calling code just cleans up the VMA and does not invoke perf_mmap_close(). This leaks reference counts, corrupts user->vm accounting and also results in an unbalanced invocation of event::event_mapped(). Cure this by moving the event::event_mapped() invocation before the map_range() call so that on map_range() failure perf_mmap_close() can be invoked without causing an unbalanced event::event_unmapped() call. perf_mmap_close() undoes the reference counts and eventually frees buffers.

Affected Products 2

References 3

• git.kernel.org https://git.kernel.org/stable/c/831e1c90a5d72e6977a57c44f47c46b73a438695
  Patch
• git.kernel.org https://git.kernel.org/stable/c/a9025f73c88d9d6e125743a43afc569da3ce5328
  Patch
• git.kernel.org https://git.kernel.org/stable/c/f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820
  Patch

Remediation

• git.kernel.org https://git.kernel.org/stable/c/831e1c90a5d72e6977a57c44f47c46b73a438695
  Patch
• git.kernel.org https://git.kernel.org/stable/c/a9025f73c88d9d6e125743a43afc569da3ce5328
  Patch
• git.kernel.org https://git.kernel.org/stable/c/f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820
  Patch