CVE-2025-21895
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21895
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21895.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-21895
- Downstream
- Related
- Published
- 2025-04-01T15:26:48Z
- Modified
- 2025-10-10T07:44:36.630709Z
- Summary
- perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Order the PMU list to fix warning about unordered pmuctxlist
Syskaller triggers a warning due to prevepc->pmu != nextepc->pmu in perfeventswaptaskctxdata(). vmcore shows that two lists have the same perfeventpmucontext, but not in the same order.
The problem is that the order of pmuctxlist for the parent is impacted by the time when an event/PMU is added. While the order for a child is impacted by the event order in the pinnedgroups and flexiblegroups. So the order of pmuctxlist in the parent and child may be different.
To fix this problem, insert the perfeventpmucontext to its proper place after iteration of the pmuctx_list.
The follow testcase can trigger above warning:
# perf record -e cycles --call-graph lbr -- taskset -c 3 ./a.out & # perf stat -e cpu-clock,cs -p xxx // xxx is the pid of a.out
test.c
void main() { int count = 0; pid_t pid;
printf("%d running\n", getpid()); sleep(30); printf("running\n"); pid = fork(); if (pid == -1) { printf("fork error\n"); return; } if (pid == 0) { while (1) { count++; } } else { while (1) { count++; } }}
The testcase first opens an LBR event, so it will allocate taskctxdata, and then open tracepoint and software events, so the parent context will have 3 different perfeventpmucontexts. On inheritance, child ctx will insert the perfeventpmucontext in another order and the warning will trigger.
[ mingo: Tidied up the changelog. ]
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/2016066c66192a99d9e0ebf433789c490a6785a2
- https://git.kernel.org/stable/c/3e812a70732d84b7873cea61a7f6349b9a9dcbf5
- https://git.kernel.org/stable/c/7d582eb6e4e100959ba07083d7563453c8c2a343
- https://git.kernel.org/stable/c/f0c3971405cef6892844016aa710121a02da3a23
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbd27568117664b8b3e259721393df420ed51f57bFixedf0c3971405cef6892844016aa710121a02da3a23
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbd27568117664b8b3e259721393df420ed51f57bFixed7d582eb6e4e100959ba07083d7563453c8c2a343
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbd27568117664b8b3e259721393df420ed51f57bFixed3e812a70732d84b7873cea61a7f6349b9a9dcbf5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbd27568117664b8b3e259721393df420ed51f57bFixed2016066c66192a99d9e0ebf433789c490a6785a2