linux-cve-announce - CVE-2025-22094: powerpc/perf: Fix ref-counting on the PMU 'vpa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025041618-CVE-2025-22094-d447@gregkh>
Date: Wed, 16 Apr 2025 16:13:05 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-22094: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'

Commit 176cda0619b6 ("powerpc/perf: Add perf interface to expose vpa
counters") introduced 'vpa_pmu' to expose Book3s-HV nested APIv2 provided
L1<->L2 context switch latency counters to L1 user-space via
perf-events. However the newly introduced PMU named 'vpa_pmu' doesn't
assign ownership of the PMU to the module 'vpa_pmu'. Consequently the
module 'vpa_pmu' can be unloaded while one of the perf-events are still
active, which can lead to kernel oops and panic of the form below on a
Pseries-LPAR:

BUG: Kernel NULL pointer dereference on read at 0x00000058
<snip>
 NIP [c000000000506cb8] event_sched_out+0x40/0x258
 LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0
 Call Trace:
 [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable)
 [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0
 [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120
<snip>
 Kernel panic - not syncing: Aiee, killing interrupt handler!

Fix this by adding the module ownership to 'vpa_pmu' so that the module
'vpa_pmu' is ref-counted and prevented from being unloaded when perf-events
are initialized.

The Linux kernel CVE team has assigned CVE-2025-22094 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.13 with commit 176cda0619b6c17a553625f6e2fcbc3981ad667d and fixed in 6.13.11 with commit 70ea7c5189197c6f5acdcfd8a2651be2c41e2faa
	Issue introduced in 6.13 with commit 176cda0619b6c17a553625f6e2fcbc3981ad667d and fixed in 6.14.2 with commit 6cf045b51e2c5721db7e55305f09ee32741e00f9
	Issue introduced in 6.13 with commit 176cda0619b6c17a553625f6e2fcbc3981ad667d and fixed in 6.15-rc1 with commit ff99d5b6a246715f2257123cdf6c4a29cb33aa78

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-22094
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	arch/powerpc/perf/vpa-pmu.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/70ea7c5189197c6f5acdcfd8a2651be2c41e2faa
	https://git.kernel.org/stable/c/6cf045b51e2c5721db7e55305f09ee32741e00f9
	https://git.kernel.org/stable/c/ff99d5b6a246715f2257123cdf6c4a29cb33aa78