CVE: CVE-2025-39767
Published: 2025-09-11
Description: In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Optimize module load time by optimizing PLT/GOT counting

When enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD and
CONFIG_PREEMPT_VOLUNTARY at the same time, there will be soft deadlock,
the relevant logs are as follows:

rcu: INFO: rcu_sched self-detected stall on CPU
...
Call Trace:
[<[PII_REDACTED]24f9e4>] show_stack+0x5c/0x180
[<[PII_REDACTED]2482f4>] dump_stack_lvl+0x94/0xbc
[<[PII_REDACTED]>] rcu_dump_cpu_stacks+0x1fc/0x280
[<[PII_REDACTED]37ac80>] rcu_sched_clock_irq+0x720/0xf88
[<[PII_REDACTED]396c34>] update_process_times+0xb4/0x150
[<[PII_REDACTED]3b2474>] tick_nohz_handler+0xf4/0x250
[<[PII_REDACTED]397e28>] __hrtimer_run_queues+0x1d0/0x428
[<[PII_REDACTED]399b2c>] hrtimer_interrupt+0x214/0x538
[<[PII_REDACTED]>] constant_timer_interrupt+0x64/0x80
[<[PII_REDACTED]>] __handle_irq_event_percpu+0x78/0x1a0
[<[PII_REDACTED]349a78>] handle_irq_event_percpu+0x18/0x88
[<[PII_REDACTED]354c00>] handle_percpu_irq+0x90/0xf0
[<[PII_REDACTED]348c74>] handle_irq_desc+0x94/0xb8
[<[PII_REDACTED]012b28>] handle_cpu_irq+0x68/0xa0
[<[PII_REDACTED]def8c0>] handle_loongarch_irq+0x30/0x48
[<[PII_REDACTED]def958>] do_vint+0x80/0xd0
[<[PII_REDACTED]268a0c>] kasan_mem_to_shadow.part.0+0x2c/0x2a0
[<[PII_REDACTED]6344f4>] __asan_load8+0x4c/0x120
[<[PII_REDACTED]25c0d0>] module_frob_arch_sections+0x5c8/0x6b8
[<[PII_REDACTED]3895f0>] load_module+0x9e0/0x2958
[<[PII_REDACTED]38b770>] __do_sys_init_module+0x208/0x2d0
[<[PII_REDACTED]df0c34>] do_syscall+0x94/0x190
[<[PII_REDACTED]24d6fc>] handle_syscall+0xbc/0x158

After analysis, this is because the slow speed of loading the amdgpu
module leads to the long time occupation of the cpu and then the soft
deadlock.

When loading a module, module_frob_arch_sections() tries to figure out
the number of PLTs/GOTs that will be needed to handle all the RELAs. It
will call the count_max_entries() to find in an out-of-order date which
counting algorithm has O(n^2) complexity.

To make it faster, we sort the relocation list by info and addend. That
way, to check for a duplicate relocation, it just needs to compare with
the previous entry. This reduces the complexity of the algorithm to O(n
 log n), as done in commit d4e0340919fb ("arm64/module: Optimize module
load time by optimizing PLT counting"). This gives sinificant reduction
in module load time for modules with large number of relocations.

After applying this patch, the soft deadlock problem has been solved,
and the kernel starts normally without "Call Trace".

Using the default configuration to test some modules, the results are as
follows:

Module              Size
ip_tables           36K
fat                 143K
radeon              2.5MB
amdgpu              16MB

Without this patch:
Module              Module load time (ms)	Count(PLTs/GOTs)
ip_tables           18				59/6
fat                 0				162/14
radeon              54				1221/84
amdgpu              1411			4525/1098

With this patch:
Module              Module load time (ms)	Count(PLTs/GOTs)
ip_tables           18				59/6
fat                 0				162/14
radeon              22				1221/84
amdgpu              45				4525/1098
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/5189c0b7c251363a4dd7678ed11b054c54f36f6f; https://git.kernel.org/stable/c/63dbd8fb2af3a[PII_REDACTED]9a9acb2d11ef65c06; https://git.kernel.org/stable/c/a096b0280168d0c8b0ec1cbbfd56c8b81af8c7d8