| From bippy-1.2.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-22094: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' |
| |
| Commit 176cda0619b6 ("powerpc/perf: Add perf interface to expose vpa |
| counters") introduced 'vpa_pmu' to expose Book3s-HV nested APIv2 provided |
| L1<->L2 context switch latency counters to L1 user-space via |
| perf-events. However the newly introduced PMU named 'vpa_pmu' doesn't |
| assign ownership of the PMU to the module 'vpa_pmu'. Consequently the |
| module 'vpa_pmu' can be unloaded while one of the perf-events are still |
| active, which can lead to kernel oops and panic of the form below on a |
| Pseries-LPAR: |
| |
| BUG: Kernel NULL pointer dereference on read at 0x00000058 |
| <snip> |
| NIP [c000000000506cb8] event_sched_out+0x40/0x258 |
| LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0 |
| Call Trace: |
| [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable) |
| [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0 |
| [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120 |
| <snip> |
| Kernel panic - not syncing: Aiee, killing interrupt handler! |
| |
| Fix this by adding the module ownership to 'vpa_pmu' so that the module |
| 'vpa_pmu' is ref-counted and prevented from being unloaded when perf-events |
| are initialized. |
| |
| The Linux kernel CVE team has assigned CVE-2025-22094 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.13 with commit 176cda0619b6c17a553625f6e2fcbc3981ad667d and fixed in 6.13.11 with commit 70ea7c5189197c6f5acdcfd8a2651be2c41e2faa |
| Issue introduced in 6.13 with commit 176cda0619b6c17a553625f6e2fcbc3981ad667d and fixed in 6.14.2 with commit 6cf045b51e2c5721db7e55305f09ee32741e00f9 |
| Issue introduced in 6.13 with commit 176cda0619b6c17a553625f6e2fcbc3981ad667d and fixed in 6.15 with commit ff99d5b6a246715f2257123cdf6c4a29cb33aa78 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-22094 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/powerpc/perf/vpa-pmu.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/70ea7c5189197c6f5acdcfd8a2651be2c41e2faa |
| https://git.kernel.org/stable/c/6cf045b51e2c5721db7e55305f09ee32741e00f9 |
| https://git.kernel.org/stable/c/ff99d5b6a246715f2257123cdf6c4a29cb33aa78 |
