[SRU][N][PATCH 1/1] perf/core: Exit early on perf_mmap() fail

[Cengiz Can]

From: Thomas Gleixner <tglx at linutronix.de>

When perf_mmap() fails to allocate a buffer, it still invokes the
event_mapped() callback of the related event. On X86 this might increase
the perf_rdpmc_allowed reference counter. But nothing undoes this as
perf_mmap_close() is never called in this case, which causes another
reference count leak.

Return early on failure to prevent that.

Fixes: 1e0fb9ec679c ("perf: Add pmu callbacks to track event mapping and unmapping")
Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes at oracle.com>
Cc: stable at vger.kernel.org
(backported from commit 07091aade394f690e7b655578140ef84d0e8d7b0)
[bot_kybele: Kept the essential early "if (ret) return ret;" exit (which
 prevents the event_mapped leak), but dropped upstream's
 map_range/get_mapped/mapped refactor since this tree lacks those and uses the
 older event->pmu->event_mapped() callback directly.]
CVE-2025-38565
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 kernel/events/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 9d802f19dc00..f8013daf9b74 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6728,6 +6728,9 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
 		mutex_unlock(aux_mutex);
 	mutex_unlock(&event->mmap_mutex);
 
+	if (ret)
+		return ret;
+
 	/*
 	 * Since pinned accounting is per vm we cannot allow fork() to copy our
 	 * vma.
-- 
2.53.0