CVE: CVE-2022-48752
Published: 2024-06-20
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending

Running selftest with CONFIG_PPC_IRQ_SOFT_MASK_DEBUG enabled in kernel
triggered below warning:

[  172.851380] ------------[ cut here ]------------
[  172.851391] WARNING: CPU: 8 PID: 2901 at arch/powerpc/include/asm/hw_irq.h:246 power_pmu_disable+0x270/0x280
[  172.851402] Modules linked in: dm_mod bonding nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables rfkill nfnetlink sunrpc xfs libcrc32c pseries_rng xts vmx_crypto uio_pdrv_genirq uio sch_fq_codel ip_tables ext4 mbcache jbd2 sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp fuse
[  172.851442] CPU: 8 PID: 2901 Comm: lost_exception_ Not tainted 5.16.0-rc5-03218-g[PII_REDACTED]98 #2
[  172.851451] NIP:  c[PII_REDACTED]3d600 LR: c[PII_REDACTED]3d5a4 CTR: c[PII_REDACTED]3b180
[  172.851458] REGS: c[PII_REDACTED]87860 TRAP: 0700   Not tainted  (5.16.0-rc5-03218-g[PII_REDACTED]98)
[  172.851465] MSR:  [PII_REDACTED] <SF,EE,ME,IR,DR,RI,LE>  CR: 48004884  XER: 20040000
[  172.851482] CFAR: c[PII_REDACTED]3d5b4 IRQMASK: 1
[  172.851482] GPR00: c[PII_REDACTED]3d5a4 c[PII_REDACTED]87b00 c000000002a10600 [PII_REDACTED]
[  172.851482] GPR04: [PII_REDACTED] c0000008ba08f0a8 [PII_REDACTED] 00000008b7ed0000
[  172.851482] GPR08:[PII_REDACTED]6194f6 [PII_REDACTED] c[PII_REDACTED]3b118 c000000000d58e68
[  172.851482] GPR12: c[PII_REDACTED]3d390 c00000001ec54a80 [PII_REDACTED] [PII_REDACTED]
[  172.851482] GPR16: [PII_REDACTED] [PII_REDACTED] c000000015d5c708 c[PII_REDACTED]396d0
[  172.851482] GPR20: [PII_REDACTED] [PII_REDACTED] c00000000a3bbf40 [PII_REDACTED]
[  172.851482] GPR24: [PII_REDACTED] c0000008ba097400 c[PII_REDACTED]e0d00 c00000000a3bb600
[  172.851482] GPR28: c000000015d5c700 [PII_REDACTED] [PII_REDACTED] c0000008ba0020d8
[  172.851549] NIP [c[PII_REDACTED]3d600] power_pmu_disable+0x270/0x280
[  172.851557] LR [c[PII_REDACTED]3d5a4] power_pmu_disable+0x214/0x280
[  172.851565] Call Trace:
[  172.851568] [c[PII_REDACTED]87b00] [c[PII_REDACTED]3d5a4] power_pmu_disable+0x214/0x280 (unreliable)
[  172.851579] [c[PII_REDACTED]87b40] [c[PII_REDACTED]403ac] perf_pmu_disable+0x4c/0x60
[  172.851588] [c[PII_REDACTED]87b60] [c[PII_REDACTED]445e4] __perf_event_task_sched_out+0x1d4/0x660
[  172.851596] [c[PII_REDACTED]87c50] [c000000000d1175c] __schedule+0xbcc/0x12a0
[  172.851602] [c[PII_REDACTED]87d60] [c000000000d11ea8] schedule+0x78/0x140
[  172.851608] [c[PII_REDACTED]87d90] [c[PII_REDACTED]a8080] sys_sched_yield+0x20/0x40
[  172.851615] [c[PII_REDACTED]87db0] [c[PII_REDACTED]334dc] system_call_exception+0x18c/0x380
[  172.851622] [c[PII_REDACTED]87e10] [c[PII_REDACTED]0c74c] system_call_common+0xec/0x268

The warning indicates that MSR_EE being set(interrupt enabled) when
there was an overflown PMC detected. This could happen in
power_pmu_disable since it runs under interrupt soft disable
condition ( local_irq_save ) and not with interrupts hard disabled.
commit 2c9ac51b850d ("powerpc/perf: Fix PMU callbacks to clear
pending PMI before resetting an overflown PMC") intended to clear
PMI pending bit in Paca when disabling the PMU. It could happen
that PMC gets overflown while code is in power_pmu_disable
callback function. Hence add a check to see if PMI pending bit
is set in Paca before clearing it via clear_pmi_pending.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/28aaed966e76807a71de79dd40a8eee9042374dd; https://git.kernel.org/stable/c/55402a4618721f350a9ab660bb42717d8aa18e7c; https://git.kernel.org/stable/c/fa4ad064a6bd49208221df5e62adf27b426d1720