CVE-2022-49607: perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix data race between perfeventsetoutput() and perfmmapclose()

Yang Jihing reported a race between perfeventsetoutput() and perfmmapclose():

CPU1 CPU2

perfmmapclose(e2) if (atomicdecandtest(&e2->rb->mmapcount)) // 1 - > 0 detachrest = true

ioctl(e1, IOCSETOUTPUT, e2) perfeventsetoutput(e1, e2)

... listforeachentryrcu(e, &e2->rb->eventlist, rbentry) ringbufferattach(e, NULL); // e1 isn't yet added and // therefore not detached

ringbufferattach(e1, e2->rb) listaddrcu(&e1->rbentry, &e2->rb->eventlist)

After this; e1 is attached to an unmapped rb and a subsequent perfmmap() will loop forever more:

again: mutexlock(&e->mmapmutex); if (event->rb) { ... if (!atomicincnotzero(&e->rb->mmapcount)) { ... mutexunlock(&e->mmapmutex); goto again; } }

The loop in perfmmapclose() holds e2->mmapmutex, while the attach in perfeventsetoutput() holds e1->mmapmutex. As such there is no serialization to avoid this race.

Change perfeventsetoutput() to take both e1->mmapmutex and e2->mmapmutex to alleviate that problem. Additionally, have the loop in perfmmap() detach the rb directly, this avoids having to wait for the concurrent perfmmapclose() to get around to doing it to make progress.