In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix data race between perfeventsetoutput() and perfmmap_close()
Yang Jihing reported a race between perfeventsetoutput() and perfmmap_close():
CPU1 CPU2
perf_mmap_close(e2)
if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0
detach_rest = true
ioctl(e1, IOC_SET_OUTPUT, e2)
perf_event_set_output(e1, e2)
...
list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry)
ring_buffer_attach(e, NULL);
// e1 isn't yet added and
// therefore not detached
ring_buffer_attach(e1, e2->rb)
list_add_rcu(&e1->rb_entry,
&e2->rb->event_list)
After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more:
again:
mutex_lock(&e->mmap_mutex);
if (event->rb) {
...
if (!atomic_inc_not_zero(&e->rb->mmap_count)) {
...
mutex_unlock(&e->mmap_mutex);
goto again;
}
}
The loop in perfmmapclose() holds e2->mmapmutex, while the attach in perfeventsetoutput() holds e1->mmap_mutex. As such there is no serialization to avoid this race.
Change perfeventsetoutput() to take both e1->mmapmutex and e2->mmapmutex to alleviate that problem. Additionally, have the loop in perfmmap() detach the rb directly, this avoids having to wait for the concurrent perfmmapclose() to get around to doing it to make progress.
[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e3c69803dada336893640110cb87221bb01dcf",
"signature_type": "Function",
"id": "CVE-2022-49607-0b2bb1e8"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"224124218359667422659571508354204996414",
"293118608361276079180471921503946451676",
"32740396110297505493220285899195886703",
"198536047467187256222216014676321538716",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43128b3eee337824158f34da6648163d2f2fb937",
"signature_type": "Line",
"id": "CVE-2022-49607-1d911771"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"224124218359667422659571508354204996414",
"293118608361276079180471921503946451676",
"32740396110297505493220285899195886703",
"198536047467187256222216014676321538716",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9391ff7a7c5f113d6f2bf6621d49110950de49c",
"signature_type": "Line",
"id": "CVE-2022-49607-21e272c4"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f5417194136517ee9bbd6511249e5310e5617c",
"signature_type": "Function",
"id": "CVE-2022-49607-296638da"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"65860627800235195139052717092742185300",
"170549810607023228326757354068725858860",
"47134453799595254244024951596898936333",
"6974452004226315451938124306708773872",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f836f9ac95df15f1e0af4beb0ec20021e8c91998",
"signature_type": "Line",
"id": "CVE-2022-49607-2fcaf746"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "71875383238999652165160790512084935328",
"length": 3257.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bbd868099287ff9027db59029b502fcfa2202a0",
"signature_type": "Function",
"id": "CVE-2022-49607-31be71ad"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c",
"signature_type": "Function",
"id": "CVE-2022-49607-4943cc42"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "207405282412377723346182020896845864004",
"length": 3394.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da3c256e2d0ebc87c7db0c605c9692b6f1722074",
"signature_type": "Function",
"id": "CVE-2022-49607-4b45abde"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43128b3eee337824158f34da6648163d2f2fb937",
"signature_type": "Function",
"id": "CVE-2022-49607-55e144ad"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"65860627800235195139052717092742185300",
"170549810607023228326757354068725858860",
"47134453799595254244024951596898936333",
"6974452004226315451938124306708773872",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c",
"signature_type": "Line",
"id": "CVE-2022-49607-57500ce7"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"224124218359667422659571508354204996414",
"293118608361276079180471921503946451676",
"32740396110297505493220285899195886703",
"198536047467187256222216014676321538716",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e3c69803dada336893640110cb87221bb01dcf",
"signature_type": "Line",
"id": "CVE-2022-49607-5e356345"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "272201989724457301681972481826658165473",
"length": 3274.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f5417194136517ee9bbd6511249e5310e5617c",
"signature_type": "Function",
"id": "CVE-2022-49607-6762cb79"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9391ff7a7c5f113d6f2bf6621d49110950de49c",
"signature_type": "Function",
"id": "CVE-2022-49607-6c5b06b9"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "207405282412377723346182020896845864004",
"length": 3394.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e3c69803dada336893640110cb87221bb01dcf",
"signature_type": "Function",
"id": "CVE-2022-49607-761a343d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"65860627800235195139052717092742185300",
"170549810607023228326757354068725858860",
"47134453799595254244024951596898936333",
"6974452004226315451938124306708773872",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17f5417194136517ee9bbd6511249e5310e5617c",
"signature_type": "Line",
"id": "CVE-2022-49607-7690afcc"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "272201989724457301681972481826658165473",
"length": 3274.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f836f9ac95df15f1e0af4beb0ec20021e8c91998",
"signature_type": "Function",
"id": "CVE-2022-49607-7874b26f"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f836f9ac95df15f1e0af4beb0ec20021e8c91998",
"signature_type": "Function",
"id": "CVE-2022-49607-7a453e8d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bbd868099287ff9027db59029b502fcfa2202a0",
"signature_type": "Function",
"id": "CVE-2022-49607-90f7872f"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "291627205285032688333918925650614366054",
"length": 3407.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c",
"signature_type": "Function",
"id": "CVE-2022-49607-9f79a015"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_event_set_output",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "125873618579424848283981369294751604664",
"length": 752.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da3c256e2d0ebc87c7db0c605c9692b6f1722074",
"signature_type": "Function",
"id": "CVE-2022-49607-a981912f"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"224124218359667422659571508354204996414",
"293118608361276079180471921503946451676",
"32740396110297505493220285899195886703",
"198536047467187256222216014676321538716",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da3c256e2d0ebc87c7db0c605c9692b6f1722074",
"signature_type": "Line",
"id": "CVE-2022-49607-bb92aaf7"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "207405282412377723346182020896845864004",
"length": 3394.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9391ff7a7c5f113d6f2bf6621d49110950de49c",
"signature_type": "Function",
"id": "CVE-2022-49607-e77d2ffe"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
},
"digest": {
"line_hashes": [
"251228251743609153073273704858661950130",
"288990977526948563752979886586740741350",
"306661771382956563308907551495911077997",
"143042804579032055925497100408274014927",
"59398987158553049447721140479465158007",
"63482085072730369636294427100304565852",
"65860627800235195139052717092742185300",
"170549810607023228326757354068725858860",
"47134453799595254244024951596898936333",
"6974452004226315451938124306708773872",
"160690493735287992173721836839143028351",
"169411555129507554621483429898381631567",
"1536283697299564171144483330215167579",
"291283360038417955169219415480207475509",
"184946932210656775467840250774550289910",
"188817876040043908642171554628688331757",
"7650154582213523878814575728041166448",
"285402396709047263853811404286497424174",
"193415344301647782431993929148054060240",
"251401775038582893556126654771719475252",
"276149938508551596554554977613814815653",
"333342589996444876995353607401642223006",
"236342320621857084981314472125187375153",
"83825931145323993659948935012673872758",
"163368452307730786116452220957162594220",
"51222345415604190482127217961223800686",
"167441929495104345087046063584996153119",
"174774716199408846500763126042949616961",
"184996157644587582642138277403596900715",
"31112634207874923707047892051488426065",
"218505647498444760338536839884435421870",
"75661938321393872473405982984761460340",
"6607566657828262817445645981830127986",
"103830469880144234394606313221731830624",
"266947836760663095011837930747769397019",
"337178213421371015327566614239257670543"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bbd868099287ff9027db59029b502fcfa2202a0",
"signature_type": "Line",
"id": "CVE-2022-49607-f5da478e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "perf_mmap",
"file": "kernel/events/core.c"
},
"digest": {
"function_hash": "207405282412377723346182020896845864004",
"length": 3394.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43128b3eee337824158f34da6648163d2f2fb937",
"signature_type": "Function",
"id": "CVE-2022-49607-f7870bc8"
}
]