Message-ID: <2025050135-CVE-2025-37747-6e35@gregkh>
Date: Thu,  1 May 2025 14:56:53 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-37747: perf: Fix hang while freeing sigtrap event

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix hang while freeing sigtrap event

Perf can hang while freeing a sigtrap event if a related deferred
signal hadn't managed to be sent before the file got closed:

perf_event_overflow()
   task_work_add(perf_pending_task)

fput()
   task_work_add(____fput())

task_work_run()
    ____fput()
        perf_release()
            perf_event_release_kernel()
                _free_event()
                    perf_pending_task_sync()
                        task_work_cancel() -> FAILED
                        rcuwait_wait_event()

Once task_work_run() is running, the list of pending callbacks is
removed from the task_struct and from this point on task_work_cancel()
can't remove any pending and not yet started work items, hence the
task_work_cancel() failure and the hang on rcuwait_wait_event().

Task work could be changed to remove one work at a time, so a work
running on the current task can always cancel a pending one, however
the wait / wake design is still subject to inverted dependencies when
remote targets are involved, as pictured by Oleg:

T1                                                      T2

fd = perf_event_open(pid => T2->pid);                  fd = perf_event_open(pid => T1->pid);
close(fd)                                              close(fd)
    <IRQ>                                                  <IRQ>
    perf_event_overflow()                                  perf_event_overflow()
       task_work_add(perf_pending_task)                        task_work_add(perf_pending_task)
    </IRQ>                                                 </IRQ>
    fput()                                                 fput()
        task_work_add(____fput())                              task_work_add(____fput())

    task_work_run()                                        task_work_run()
        ____fput()                                             ____fput()
            perf_release()                                         perf_release()
                perf_event_release_kernel()                            perf_event_release_kernel()
                    _free_event()                                          _free_event()
                        perf_pending_task_sync()                               perf_pending_task_sync()
                            rcuwait_wait_event()                                   rcuwait_wait_event()

Therefore the only option left is to acquire the event reference count
upon queueing the perf task work and release it from the task work, just
like it was done before 3a5465418f5f ("perf: Fix event leak upon exec and file release")
but without the leaks it fixed.

Some adjustments are necessary to make it work:

* A child event might dereference its parent upon freeing. Care must be
  taken to release the parent last.

* Some places assuming the event doesn't have any reference held and
  therefore can be freed right away must instead put the reference and
  let the reference counting to its job.

The Linux kernel CVE team has assigned CVE-2025-37747 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 3a5465418f5fd970e86a86c7f4075be262682840 and fixed in 6.12.24 with commit fa1827fa968c0674e9b6fca223fa9fb4da4493eb
	Issue introduced in 6.11 with commit 3a5465418f5fd970e86a86c7f4075be262682840 and fixed in 6.13.12 with commit 665b87b8f8b3aeb49083ef3b65c4953e7753fc12
	Issue introduced in 6.11 with commit 3a5465418f5fd970e86a86c7f4075be262682840 and fixed in 6.14.3 with commit 1267bd38f161c1a27d9b722de017027167a225a0
	Issue introduced in 6.11 with commit 3a5465418f5fd970e86a86c7f4075be262682840 and fixed in 6.15-rc2 with commit 56799bc035658738f362acec3e7647bb84e68933
	Issue introduced in 5.15.165 with commit 9ad46f1fef421d43cdab3a7d1744b2f43b54dae0
	Issue introduced in 6.1.103 with commit ed2c202dac55423a52d7e2290f2888bf08b8ee99
	Issue introduced in 6.6.44 with commit 104e258a004037bc7dba9f6085c71dad6af57ad4
	Issue introduced in 6.10.3 with commit f34d8307a73a18de5320fcc6f40403146d061891

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-37747
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/perf_event.h
	kernel/events/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fa1827fa968c0674e9b6fca223fa9fb4da4493eb
	https://git.kernel.org/stable/c/665b87b8f8b3aeb49083ef3b65c4953e7753fc12
	https://git.kernel.org/stable/c/1267bd38f161c1a27d9b722de017027167a225a0
	https://git.kernel.org/stable/c/56799bc035658738f362acec3e7647bb84e68933

Powered by blists - more mailing lists