CVE-2025-21733

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing/osnoise: Fix resetting of tracepoints<br /> <br /> If a timerlat tracer is started with the osnoise option OSNOISE_WORKLOAD<br /> disabled, but then that option is enabled and timerlat is removed, the<br /> tracepoints that were enabled on timerlat registration do not get<br /> disabled. If the option is disabled again and timelat is started, then it<br /> triggers a warning in the tracepoint code due to registering the<br /> tracepoint again without ever disabling it.<br /> <br /> Do not use the same user space defined options to know to disable the<br /> tracepoints when timerlat is removed. Instead, set a global flag when it<br /> is enabled and use that flag to know to disable the events.<br /> <br /> ~# echo NO_OSNOISE_WORKLOAD &gt; /sys/kernel/tracing/osnoise/options<br /> ~# echo timerlat &gt; /sys/kernel/tracing/current_tracer<br /> ~# echo OSNOISE_WORKLOAD &gt; /sys/kernel/tracing/osnoise/options<br /> ~# echo nop &gt; /sys/kernel/tracing/current_tracer<br /> ~# echo NO_OSNOISE_WORKLOAD &gt; /sys/kernel/tracing/osnoise/options<br /> ~# echo timerlat &gt; /sys/kernel/tracing/current_tracer<br /> <br /> Triggers:<br /> <br /> ------------[ cut here ]------------<br /> WARNING: CPU: 6 PID: 1337 at kernel/tracepoint.c:294 tracepoint_add_func+0x3b6/0x3f0<br /> Modules linked in:<br /> CPU: 6 UID: 0 PID: 1337 Comm: rtla Not tainted 6.13.0-rc4-test-00018-ga867c441128e-dirty #73<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014<br /> RIP: 0010:tracepoint_add_func+0x3b6/0x3f0<br /> Code: 48 8b 53 28 48 8b 73 20 4c 89 04 24 e8 23 59 11 00 4c 8b 04 24 e9 36 fe ff ff 0f 0b b8 ea ff ff ff 45 84 e4 0f 84 68 fe ff ff 0b e9 61 fe ff ff 48 8b 7b 18 48 85 ff 0f 84 4f ff ff ff 49 8b<br /> RSP: 0018:ffffb9b003a87ca0 EFLAGS: 00010202<br /> RAX: 00000000ffffffef RBX: ffffffff92f30860 RCX: 0000000000000000<br /> RDX: 0000000000000000 RSI: ffff9bf59e91ccd0 RDI: ffffffff913b6410<br /> RBP: 000000000000000a R08: 00000000000005c7 R09: 0000000000000002<br /> R10: ffffb9b003a87ce0 R11: 0000000000000002 R12: 0000000000000001<br /> R13: ffffb9b003a87ce0 R14: ffffffffffffffef R15: 0000000000000008<br /> FS: 00007fce81209240(0000) GS:ffff9bf6fdd00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 000055e99b728000 CR3: 00000001277c0002 CR4: 0000000000172ef0<br /> Call Trace:<br /> <br /> ? __warn.cold+0xb7/0x14d<br /> ? tracepoint_add_func+0x3b6/0x3f0<br /> ? report_bug+0xea/0x170<br /> ? handle_bug+0x58/0x90<br /> ? exc_invalid_op+0x17/0x70<br /> ? asm_exc_invalid_op+0x1a/0x20<br /> ? __pfx_trace_sched_migrate_callback+0x10/0x10<br /> ? tracepoint_add_func+0x3b6/0x3f0<br /> ? __pfx_trace_sched_migrate_callback+0x10/0x10<br /> ? __pfx_trace_sched_migrate_callback+0x10/0x10<br /> tracepoint_probe_register+0x78/0xb0<br /> ? __pfx_trace_sched_migrate_callback+0x10/0x10<br /> osnoise_workload_start+0x2b5/0x370<br /> timerlat_tracer_init+0x76/0x1b0<br /> tracing_set_tracer+0x244/0x400<br /> tracing_set_trace_write+0xa0/0xe0<br /> vfs_write+0xfc/0x570<br /> ? do_sys_openat2+0x9c/0xe0<br /> ksys_write+0x72/0xf0<br /> do_syscall_64+0x79/0x1c0<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e