| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-48752: powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending |
| |
| Running selftest with CONFIG_PPC_IRQ_SOFT_MASK_DEBUG enabled in kernel |
| triggered below warning: |
| |
| [ 172.851380] ------------[ cut here ]------------ |
| [ 172.851391] WARNING: CPU: 8 PID: 2901 at arch/powerpc/include/asm/hw_irq.h:246 power_pmu_disable+0x270/0x280 |
| [ 172.851402] Modules linked in: dm_mod bonding nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables rfkill nfnetlink sunrpc xfs libcrc32c pseries_rng xts vmx_crypto uio_pdrv_genirq uio sch_fq_codel ip_tables ext4 mbcache jbd2 sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp fuse |
| [ 172.851442] CPU: 8 PID: 2901 Comm: lost_exception_ Not tainted 5.16.0-rc5-03218-g798527287598 #2 |
| [ 172.851451] NIP: c00000000013d600 LR: c00000000013d5a4 CTR: c00000000013b180 |
| [ 172.851458] REGS: c000000017687860 TRAP: 0700 Not tainted (5.16.0-rc5-03218-g798527287598) |
| [ 172.851465] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 48004884 XER: 20040000 |
| [ 172.851482] CFAR: c00000000013d5b4 IRQMASK: 1 |
| [ 172.851482] GPR00: c00000000013d5a4 c000000017687b00 c000000002a10600 0000000000000004 |
| [ 172.851482] GPR04: 0000000082004000 c0000008ba08f0a8 0000000000000000 00000008b7ed0000 |
| [ 172.851482] GPR08: 00000000446194f6 0000000000008000 c00000000013b118 c000000000d58e68 |
| [ 172.851482] GPR12: c00000000013d390 c00000001ec54a80 0000000000000000 0000000000000000 |
| [ 172.851482] GPR16: 0000000000000000 0000000000000000 c000000015d5c708 c0000000025396d0 |
| [ 172.851482] GPR20: 0000000000000000 0000000000000000 c00000000a3bbf40 0000000000000003 |
| [ 172.851482] GPR24: 0000000000000000 c0000008ba097400 c0000000161e0d00 c00000000a3bb600 |
| [ 172.851482] GPR28: c000000015d5c700 0000000000000001 0000000082384090 c0000008ba0020d8 |
| [ 172.851549] NIP [c00000000013d600] power_pmu_disable+0x270/0x280 |
| [ 172.851557] LR [c00000000013d5a4] power_pmu_disable+0x214/0x280 |
| [ 172.851565] Call Trace: |
| [ 172.851568] [c000000017687b00] [c00000000013d5a4] power_pmu_disable+0x214/0x280 (unreliable) |
| [ 172.851579] [c000000017687b40] [c0000000003403ac] perf_pmu_disable+0x4c/0x60 |
| [ 172.851588] [c000000017687b60] [c0000000003445e4] __perf_event_task_sched_out+0x1d4/0x660 |
| [ 172.851596] [c000000017687c50] [c000000000d1175c] __schedule+0xbcc/0x12a0 |
| [ 172.851602] [c000000017687d60] [c000000000d11ea8] schedule+0x78/0x140 |
| [ 172.851608] [c000000017687d90] [c0000000001a8080] sys_sched_yield+0x20/0x40 |
| [ 172.851615] [c000000017687db0] [c0000000000334dc] system_call_exception+0x18c/0x380 |
| [ 172.851622] [c000000017687e10] [c00000000000c74c] system_call_common+0xec/0x268 |
| |
| The warning indicates that MSR_EE being set(interrupt enabled) when |
| there was an overflown PMC detected. This could happen in |
| power_pmu_disable since it runs under interrupt soft disable |
| condition ( local_irq_save ) and not with interrupts hard disabled. |
| commit 2c9ac51b850d ("powerpc/perf: Fix PMU callbacks to clear |
| pending PMI before resetting an overflown PMC") intended to clear |
| PMI pending bit in Paca when disabling the PMU. It could happen |
| that PMC gets overflown while code is in power_pmu_disable |
| callback function. Hence add a check to see if PMI pending bit |
| is set in Paca before clearing it via clear_pmi_pending. |
| |
| The Linux kernel CVE team has assigned CVE-2022-48752 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.10.94 with commit ef798cd035f316a537fee8ed170c127f12407085 and fixed in 5.10.96 with commit 55402a4618721f350a9ab660bb42717d8aa18e7c |
| Issue introduced in 5.15.17 with commit fadcafa3959281ce2d96feedece8c75c3f95f8a5 and fixed in 5.15.19 with commit 28aaed966e76807a71de79dd40a8eee9042374dd |
| Issue introduced in 5.16.3 with commit 215a90ce3754fe509efbce6b73a4bb643c7e7528 and fixed in 5.16.5 with commit fa4ad064a6bd49208221df5e62adf27b426d1720 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-48752 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/powerpc/perf/core-book3s.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/55402a4618721f350a9ab660bb42717d8aa18e7c |
| https://git.kernel.org/stable/c/28aaed966e76807a71de79dd40a8eee9042374dd |
| https://git.kernel.org/stable/c/fa4ad064a6bd49208221df5e62adf27b426d1720 |
| https://git.kernel.org/stable/c/fb6433b48a178d4672cb26632454ee0b21056eaa |
