Lee Jia Jie 5948aaf64f perf/aux: Fix page UAF in map_range() ... map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_mutex, and mmap_mutex is per event. Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows: CPU 0 CPU 1 ===== ===== rb_alloc_aux() map_range() [1]: allocate rb->aux_pages[0] [2]: rb->aux_nr_pages++ [3]: perf_mmap_to_page() returns rb->aux_pages[0] [4]: map it as VM_PFNMAP [5]: rb->aux_pgoff = 1 munmap the page [6]: free rb->aux_pages[0] Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a mapping to a freed physical frame. Fix this by taking rb->aux_mutex across the page walk in map_range(). Fixes: b709eb872e ("perf: map pages in advance") Signed-off-by: Lee Jia Jie <jiajie.lee@starlabs.sg> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: stable@vger.kernel.org Cc: Peter Zijlstra <peterz@infradead.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Namhyung Kim <namhyung@kernel.org>		2026-07-10 12:12:24 +02:00
..
callchain.c	perf: sched: Fix perf crash with new is_user_task() helper	2026-01-30 23:06:07 +01:00
core.c	perf/aux: Fix page UAF in map_range()	2026-07-10 12:12:24 +02:00
hw_breakpoint_test.c	perf/hw_breakpoint: remove MODULE_LICENSE in non-modules	2023-04-13 13:13:52 -07:00
hw_breakpoint.c	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
internal.h	perf/core: Fix deadlock in perf_mmap() failure path	2026-05-05 12:47:20 +02:00
Makefile
ring_buffer.c	perf/core: Fix deadlock in perf_mmap() failure path	2026-05-05 12:47:20 +02:00
uprobes.c	treewide: change inode->i_ino from unsigned long to u64	2026-03-06 14:31:28 +01:00