CVE-2024-43869

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf: Fix event leak upon exec and file release<br /> <br /> The perf pending task work is never waited upon the matching event<br /> release. In the case of a child event, released via free_event()<br /> directly, this can potentially result in a leaked event, such as in the<br /> following scenario that doesn&amp;#39;t even require a weak IRQ work<br /> implementation to trigger:<br /> <br /> schedule()<br /> prepare_task_switch()<br /> =======&gt; <br /> perf_event_overflow()<br /> event-&gt;pending_sigtrap = ...<br /> irq_work_queue(&amp;event-&gt;pending_irq)<br /> pending_sigtrap = 0;<br /> atomic_long_inc_not_zero(&amp;event-&gt;refcount)<br /> task_work_add(&amp;event-&gt;pending_task)<br /> finish_lock_switch()<br /> =======&gt; <br /> perf_pending_irq()<br /> //do nothing, rely on pending task work<br /> refcount, 1, 0) != 1)<br /> // event is leaked<br /> <br /> Similar scenarios can also happen with perf_event_remove_on_exec() or<br /> simply against concurrent perf_event_release().<br /> <br /> Fix this with synchonizing against the possibly remaining pending task<br /> work while freeing the event, just like is done with remaining pending<br /> IRQ work. This means that the pending task callback neither need nor<br /> should hold a reference to the event, preventing it from ever beeing<br /> freed.