Patch "s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     s390-cpum_sf-fix-and-protect-memory-allocation-of-sd.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f4da5be665eef6be1067f7176a931f7f5d9f142a
Author: Thomas Richter <tmricht@xxxxxxxxxxxxx>
Date:   Wed Oct 30 12:37:18 2024 +0100

    s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex
    
    [ Upstream commit f55bd479d8663a4a4e403b3d308d3d1aa33d92df ]
    
    Reservation of the PMU hardware is done at first event creation
    and is protected by a pair of mutex_lock() and mutex_unlock().
    After reservation of the PMU hardware the memory
    required for the PMUs the event is to be installed on is
    allocated by allocate_buffers() and alloc_sampling_buffer().
    This done outside of the mutex protection.
    Without mutex protection two or more concurrent invocations of
    perf_event_init() may run in parallel.
    This can lead to allocation of Sample Data Blocks (SDBs)
    multiple times for the same PMU.
    Prevent this and protect memory allocation of SDBs by
    mutex.
    
    Fixes: 8a6fe8f21ec4 ("s390/cpum_sf: Use refcount_t instead of atomic_t")
    Signed-off-by: Thomas Richter <tmricht@xxxxxxxxxxxxx>
    Reviewed-by: Sumanth Korikkar <sumanthk@xxxxxxxxxxxxx>
    Reviewed-by: Hendrik Brueckner <brueckner@xxxxxxxxxxxxx>
    Signed-off-by: Heiko Carstens <hca@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index 5b765e3ccf0ca..3317f4878eaa7 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -759,7 +759,6 @@ static int __hw_perf_event_init(struct perf_event *event)
 		reserve_pmc_hardware();
 		refcount_set(&num_events, 1);
 	}
-	mutex_unlock(&pmc_reserve_mutex);
 	event->destroy = hw_perf_event_destroy;
 
 	/* Access per-CPU sampling information (query sampling info) */
@@ -848,6 +847,7 @@ static int __hw_perf_event_init(struct perf_event *event)
 		if (is_default_overflow_handler(event))
 			event->overflow_handler = cpumsf_output_event_pid;
 out:
+	mutex_unlock(&pmc_reserve_mutex);
 	return err;
 }