linux-kernel - Re: [PATCH v3 00/15] perf: Convert mmap() related reference counts to refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <185fdbcd-7c34-4f9e-bd63-52b0f7a29617@lucifer.local>
Date: Wed, 13 Aug 2025 08:11:01 +0100
From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
To: Peter Zijlstra <peterz@...radead.org>
Cc: tglx@...utronix.de, linux-kernel@...r.kernel.org,
        torvalds@...uxfoundation.org, mingo@...nel.org, namhyung@...nel.org,
        acme@...hat.com, kees@...nel.org
Subject: Re: [PATCH v3 00/15] perf: Convert mmap() related reference counts
 to refcount_t

On Tue, Aug 12, 2025 at 12:38:58PM +0200, Peter Zijlstra wrote:
> Took over the series from Thomas; much thanks to him for cleaning this up.
>
> The recently fixed reference count leaks could have been detected by using
> refcount_t and refcount_t would have mitigated the potential overflow at
> least.
>
> It turned out that converting the code as is does not work as the
> allocation code ends up doing a refcount_inc() for the first allocation,
> which causes refcount_t sanity checks to emit a UAF warning.
>
> The reason is that the code is sharing functionality at the wrong level and
> ends up being overly complicated for no reason. That's what inevitable led
> to the refcount leak problems.
>
> Address this by splitting the ringbuffer and the AUX buffer mapping and
> allocation parts out into seperate functions, which handle the reference
> counts in a sane way.
>
> That not only simplifies the code and makes it halfways comprehensible, but
> also allows to convert the mmap() related reference counts to refcount_t.
>
> It survives lightweight testing with perf and passes the perf/mmap
> selftest.
>
> Also available at:
>
>   git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git perf/core
>
> ---
> v2: https://lkml.kernel.org/r/20250811123458.050061356@linutronix.de
>
> Changes vs v2:
>  - replaced patches 4,5 with fine grained steps
>

Whole series LGTM, various nits/comments but nothing of importance.

I also build-checked every commit and checked the new mmap self test all
looks good.

Thanks for this guys, huge improvement! :)