CVE-2022-50118 (GCVE-0-2022-50118)
Vulnerability from cvelistv5
Published
2025-06-18 11:02
Modified
2025-06-18 11:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable commit 2c9ac51b850d ("powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC") added a new function "pmi_irq_pending" in hw_irq.h. This function is to check if there is a PMI marked as pending in Paca (PACA_IRQ_PMI).This is used in power_pmu_disable in a WARN_ON. The intention here is to provide a warning if there is PMI pending, but no counter is found overflown. During some of the perf runs, below warning is hit: WARNING: CPU: 36 PID: 0 at arch/powerpc/perf/core-book3s.c:1332 power_pmu_disable+0x25c/0x2c0 Modules linked in: ----- NIP [c000000000141c3c] power_pmu_disable+0x25c/0x2c0 LR [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0 Call Trace: [c000000baffcfb90] [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0 (unreliable) [c000000baffcfc10] [c0000000003e2f8c] perf_pmu_disable+0x4c/0x60 [c000000baffcfc30] [c0000000003e3344] group_sched_out.part.124+0x44/0x100 [c000000baffcfc80] [c0000000003e353c] __perf_event_disable+0x13c/0x240 [c000000baffcfcd0] [c0000000003dd334] event_function+0xc4/0x140 [c000000baffcfd20] [c0000000003d855c] remote_function+0x7c/0xa0 [c000000baffcfd50] [c00000000026c394] flush_smp_call_function_queue+0xd4/0x300 [c000000baffcfde0] [c000000000065b24] smp_ipi_demux_relaxed+0xa4/0x100 [c000000baffcfe20] [c0000000000cb2b0] xive_muxed_ipi_action+0x20/0x40 [c000000baffcfe40] [c000000000207c3c] __handle_irq_event_percpu+0x8c/0x250 [c000000baffcfee0] [c000000000207e2c] handle_irq_event_percpu+0x2c/0xa0 [c000000baffcff10] [c000000000210a04] handle_percpu_irq+0x84/0xc0 [c000000baffcff40] [c000000000205f14] generic_handle_irq+0x54/0x80 [c000000baffcff60] [c000000000015740] __do_irq+0x90/0x1d0 [c000000baffcff90] [c000000000016990] __do_IRQ+0xc0/0x140 [c0000009732f3940] [c000000bafceaca8] 0xc000000bafceaca8 [c0000009732f39d0] [c000000000016b78] do_IRQ+0x168/0x1c0 [c0000009732f3a00] [c0000000000090c8] hardware_interrupt_common_virt+0x218/0x220 This means that there is no PMC overflown among the active events in the PMU, but there is a PMU pending in Paca. The function "any_pmc_overflown" checks the PMCs on active events in cpuhw->n_events. Code snippet: <<>> if (any_pmc_overflown(cpuhw)) clear_pmi_irq_pending(); else WARN_ON(pmi_irq_pending()); <<>> Here the PMC overflown is not from active event. Example: When we do perf record, default cycles and instructions will be running on PMC6 and PMC5 respectively. It could happen that overflowed event is currently not active and pending PMI is for the inactive event. Debug logs from trace_printk: <<>> any_pmc_overflown: idx is 5: pmc value is 0xd9a power_pmu_disable: PMC1: 0x0, PMC2: 0x0, PMC3: 0x0, PMC4: 0x0, PMC5: 0xd9a, PMC6: 0x80002011 <<>> Here active PMC (from idx) is PMC5 , but overflown PMC is PMC6(0x80002011). When we handle PMI interrupt for such cases, if the PMC overflown is from inactive event, it will be ignored. Reference commit: commit bc09c219b2e6 ("powerpc/perf: Fix finding overflowed PMC in interrupt") Patch addresses two changes: 1) Fix 1 : Removal of warning ( WARN_ON(pmi_irq_pending()); ) We were printing warning if no PMC is found overflown among active PMU events, but PMI pending in PACA. But this could happen in cases where PMC overflown is not in active PMC. An inactive event could have caused the overflow. Hence the warning is not needed. To know pending PMI is from an inactive event, we need to loop through all PMC's which will cause more SPR reads via mfspr and increase in context switch. Also in existing function: perf_event_interrupt, already we ignore PMI's overflown when it is from an inactive PMC. 2) Fix 2: optimization in clearing pending PMI. Currently we check for any active PMC overflown before clearing PMI pending in Paca. This is causing additional SP ---truncated---
Impacted products
Vendor Product Version
Linux Linux Version: ef798cd035f316a537fee8ed170c127f12407085
Version: fadcafa3959281ce2d96feedece8c75c3f95f8a5
Version: 2c9ac51b850d84ee496b0a5d832ce66d411ae552
Version: 2c9ac51b850d84ee496b0a5d832ce66d411ae552
Version: 2c9ac51b850d84ee496b0a5d832ce66d411ae552
Version: 215a90ce3754fe509efbce6b73a4bb643c7e7528
Create a notification for this product.
   Linux Linux Version: 5.17
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/perf/core-book3s.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "875b2bf469d094754ac2ba9af91dcd529eb12bf6",
              "status": "affected",
              "version": "ef798cd035f316a537fee8ed170c127f12407085",
              "versionType": "git"
            },
            {
              "lessThan": "87b1a9175f08313f40fcb6d6dc536dbe451090eb",
              "status": "affected",
              "version": "fadcafa3959281ce2d96feedece8c75c3f95f8a5",
              "versionType": "git"
            },
            {
              "lessThan": "0a24ea26c3278216642a43291df7976a73a0a7ee",
              "status": "affected",
              "version": "2c9ac51b850d84ee496b0a5d832ce66d411ae552",
              "versionType": "git"
            },
            {
              "lessThan": "7e83af3dd4a3afca8f83ffde518cafd52f45b830",
              "status": "affected",
              "version": "2c9ac51b850d84ee496b0a5d832ce66d411ae552",
              "versionType": "git"
            },
            {
              "lessThan": "890005a7d98f7452cfe86dcfb2aeeb7df01132ce",
              "status": "affected",
              "version": "2c9ac51b850d84ee496b0a5d832ce66d411ae552",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "215a90ce3754fe509efbce6b73a4bb643c7e7528",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/perf/core-book3s.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "5.10.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable\n\ncommit 2c9ac51b850d (\"powerpc/perf: Fix PMU callbacks to clear\npending PMI before resetting an overflown PMC\") added a new\nfunction \"pmi_irq_pending\" in hw_irq.h. This function is to check\nif there is a PMI marked as pending in Paca (PACA_IRQ_PMI).This is\nused in power_pmu_disable in a WARN_ON. The intention here is to\nprovide a warning if there is PMI pending, but no counter is found\noverflown.\n\nDuring some of the perf runs, below warning is hit:\n\nWARNING: CPU: 36 PID: 0 at arch/powerpc/perf/core-book3s.c:1332 power_pmu_disable+0x25c/0x2c0\n Modules linked in:\n -----\n\n NIP [c000000000141c3c] power_pmu_disable+0x25c/0x2c0\n LR [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0\n Call Trace:\n [c000000baffcfb90] [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0 (unreliable)\n [c000000baffcfc10] [c0000000003e2f8c] perf_pmu_disable+0x4c/0x60\n [c000000baffcfc30] [c0000000003e3344] group_sched_out.part.124+0x44/0x100\n [c000000baffcfc80] [c0000000003e353c] __perf_event_disable+0x13c/0x240\n [c000000baffcfcd0] [c0000000003dd334] event_function+0xc4/0x140\n [c000000baffcfd20] [c0000000003d855c] remote_function+0x7c/0xa0\n [c000000baffcfd50] [c00000000026c394] flush_smp_call_function_queue+0xd4/0x300\n [c000000baffcfde0] [c000000000065b24] smp_ipi_demux_relaxed+0xa4/0x100\n [c000000baffcfe20] [c0000000000cb2b0] xive_muxed_ipi_action+0x20/0x40\n [c000000baffcfe40] [c000000000207c3c] __handle_irq_event_percpu+0x8c/0x250\n [c000000baffcfee0] [c000000000207e2c] handle_irq_event_percpu+0x2c/0xa0\n [c000000baffcff10] [c000000000210a04] handle_percpu_irq+0x84/0xc0\n [c000000baffcff40] [c000000000205f14] generic_handle_irq+0x54/0x80\n [c000000baffcff60] [c000000000015740] __do_irq+0x90/0x1d0\n [c000000baffcff90] [c000000000016990] __do_IRQ+0xc0/0x140\n [c0000009732f3940] [c000000bafceaca8] 0xc000000bafceaca8\n [c0000009732f39d0] [c000000000016b78] do_IRQ+0x168/0x1c0\n [c0000009732f3a00] [c0000000000090c8] hardware_interrupt_common_virt+0x218/0x220\n\nThis means that there is no PMC overflown among the active events\nin the PMU, but there is a PMU pending in Paca. The function\n\"any_pmc_overflown\" checks the PMCs on active events in\ncpuhw-\u003en_events. Code snippet:\n\n\u003c\u003c\u003e\u003e\nif (any_pmc_overflown(cpuhw))\n \tclear_pmi_irq_pending();\n else\n \tWARN_ON(pmi_irq_pending());\n\u003c\u003c\u003e\u003e\n\nHere the PMC overflown is not from active event. Example: When we do\nperf record, default cycles and instructions will be running on PMC6\nand PMC5 respectively. It could happen that overflowed event is currently\nnot active and pending PMI is for the inactive event. Debug logs from\ntrace_printk:\n\n\u003c\u003c\u003e\u003e\nany_pmc_overflown: idx is 5: pmc value is 0xd9a\npower_pmu_disable: PMC1: 0x0, PMC2: 0x0, PMC3: 0x0, PMC4: 0x0, PMC5: 0xd9a, PMC6: 0x80002011\n\u003c\u003c\u003e\u003e\n\nHere active PMC (from idx) is PMC5 , but overflown PMC is PMC6(0x80002011).\nWhen we handle PMI interrupt for such cases, if the PMC overflown is\nfrom inactive event, it will be ignored. Reference commit:\ncommit bc09c219b2e6 (\"powerpc/perf: Fix finding overflowed PMC in interrupt\")\n\nPatch addresses two changes:\n1) Fix 1 : Removal of warning ( WARN_ON(pmi_irq_pending()); )\n   We were printing warning if no PMC is found overflown among active PMU\n   events, but PMI pending in PACA. But this could happen in cases where\n   PMC overflown is not in active PMC. An inactive event could have caused\n   the overflow. Hence the warning is not needed. To know pending PMI is\n   from an inactive event, we need to loop through all PMC\u0027s which will\n   cause more SPR reads via mfspr and increase in context switch. Also in\n   existing function: perf_event_interrupt, already we ignore PMI\u0027s\n   overflown when it is from an inactive PMC.\n\n2) Fix 2: optimization in clearing pending PMI.\n   Currently we check for any active PMC overflown before clearing PMI\n   pending in Paca. This is causing additional SP\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-18T11:02:48.672Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/875b2bf469d094754ac2ba9af91dcd529eb12bf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/87b1a9175f08313f40fcb6d6dc536dbe451090eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a24ea26c3278216642a43291df7976a73a0a7ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e83af3dd4a3afca8f83ffde518cafd52f45b830"
        },
        {
          "url": "https://git.kernel.org/stable/c/890005a7d98f7452cfe86dcfb2aeeb7df01132ce"
        }
      ],
      "title": "powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50118",
    "datePublished": "2025-06-18T11:02:48.672Z",
    "dateReserved": "2025-06-18T10:57:27.415Z",
    "dateUpdated": "2025-06-18T11:02:48.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50118\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:41.477\",\"lastModified\":\"2025-06-18T13:47:40.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable\\n\\ncommit 2c9ac51b850d (\\\"powerpc/perf: Fix PMU callbacks to clear\\npending PMI before resetting an overflown PMC\\\") added a new\\nfunction \\\"pmi_irq_pending\\\" in hw_irq.h. This function is to check\\nif there is a PMI marked as pending in Paca (PACA_IRQ_PMI).This is\\nused in power_pmu_disable in a WARN_ON. The intention here is to\\nprovide a warning if there is PMI pending, but no counter is found\\noverflown.\\n\\nDuring some of the perf runs, below warning is hit:\\n\\nWARNING: CPU: 36 PID: 0 at arch/powerpc/perf/core-book3s.c:1332 power_pmu_disable+0x25c/0x2c0\\n Modules linked in:\\n -----\\n\\n NIP [c000000000141c3c] power_pmu_disable+0x25c/0x2c0\\n LR [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0\\n Call Trace:\\n [c000000baffcfb90] [c000000000141c8c] power_pmu_disable+0x2ac/0x2c0 (unreliable)\\n [c000000baffcfc10] [c0000000003e2f8c] perf_pmu_disable+0x4c/0x60\\n [c000000baffcfc30] [c0000000003e3344] group_sched_out.part.124+0x44/0x100\\n [c000000baffcfc80] [c0000000003e353c] __perf_event_disable+0x13c/0x240\\n [c000000baffcfcd0] [c0000000003dd334] event_function+0xc4/0x140\\n [c000000baffcfd20] [c0000000003d855c] remote_function+0x7c/0xa0\\n [c000000baffcfd50] [c00000000026c394] flush_smp_call_function_queue+0xd4/0x300\\n [c000000baffcfde0] [c000000000065b24] smp_ipi_demux_relaxed+0xa4/0x100\\n [c000000baffcfe20] [c0000000000cb2b0] xive_muxed_ipi_action+0x20/0x40\\n [c000000baffcfe40] [c000000000207c3c] __handle_irq_event_percpu+0x8c/0x250\\n [c000000baffcfee0] [c000000000207e2c] handle_irq_event_percpu+0x2c/0xa0\\n [c000000baffcff10] [c000000000210a04] handle_percpu_irq+0x84/0xc0\\n [c000000baffcff40] [c000000000205f14] generic_handle_irq+0x54/0x80\\n [c000000baffcff60] [c000000000015740] __do_irq+0x90/0x1d0\\n [c000000baffcff90] [c000000000016990] __do_IRQ+0xc0/0x140\\n [c0000009732f3940] [c000000bafceaca8] 0xc000000bafceaca8\\n [c0000009732f39d0] [c000000000016b78] do_IRQ+0x168/0x1c0\\n [c0000009732f3a00] [c0000000000090c8] hardware_interrupt_common_virt+0x218/0x220\\n\\nThis means that there is no PMC overflown among the active events\\nin the PMU, but there is a PMU pending in Paca. The function\\n\\\"any_pmc_overflown\\\" checks the PMCs on active events in\\ncpuhw-\u003en_events. Code snippet:\\n\\n\u003c\u003c\u003e\u003e\\nif (any_pmc_overflown(cpuhw))\\n \\tclear_pmi_irq_pending();\\n else\\n \\tWARN_ON(pmi_irq_pending());\\n\u003c\u003c\u003e\u003e\\n\\nHere the PMC overflown is not from active event. Example: When we do\\nperf record, default cycles and instructions will be running on PMC6\\nand PMC5 respectively. It could happen that overflowed event is currently\\nnot active and pending PMI is for the inactive event. Debug logs from\\ntrace_printk:\\n\\n\u003c\u003c\u003e\u003e\\nany_pmc_overflown: idx is 5: pmc value is 0xd9a\\npower_pmu_disable: PMC1: 0x0, PMC2: 0x0, PMC3: 0x0, PMC4: 0x0, PMC5: 0xd9a, PMC6: 0x80002011\\n\u003c\u003c\u003e\u003e\\n\\nHere active PMC (from idx) is PMC5 , but overflown PMC is PMC6(0x80002011).\\nWhen we handle PMI interrupt for such cases, if the PMC overflown is\\nfrom inactive event, it will be ignored. Reference commit:\\ncommit bc09c219b2e6 (\\\"powerpc/perf: Fix finding overflowed PMC in interrupt\\\")\\n\\nPatch addresses two changes:\\n1) Fix 1 : Removal of warning ( WARN_ON(pmi_irq_pending()); )\\n   We were printing warning if no PMC is found overflown among active PMU\\n   events, but PMI pending in PACA. But this could happen in cases where\\n   PMC overflown is not in active PMC. An inactive event could have caused\\n   the overflow. Hence the warning is not needed. To know pending PMI is\\n   from an inactive event, we need to loop through all PMC\u0027s which will\\n   cause more SPR reads via mfspr and increase in context switch. Also in\\n   existing function: perf_event_interrupt, already we ignore PMI\u0027s\\n   overflown when it is from an inactive PMC.\\n\\n2) Fix 2: optimization in clearing pending PMI.\\n   Currently we check for any active PMC overflown before clearing PMI\\n   pending in Paca. This is causing additional SP\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a24ea26c3278216642a43291df7976a73a0a7ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7e83af3dd4a3afca8f83ffde518cafd52f45b830\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/875b2bf469d094754ac2ba9af91dcd529eb12bf6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/87b1a9175f08313f40fcb6d6dc536dbe451090eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/890005a7d98f7452cfe86dcfb2aeeb7df01132ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…