CVE-2026-46272

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> coresight: tmc-etr: Fix race condition between sysfs and perf mode<br /> <br /> When trying to run perf and sysfs mode simultaneously, the WARN_ON()<br /> in tmc_etr_enable_hw() is triggered sometimes:<br /> <br /> WARNING: CPU: 42 PID: 3911571 at drivers/hwtracing/coresight/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc]<br /> [..snip..]<br /> Call trace:<br /> tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] (P)<br /> tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] (L)<br /> tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc]<br /> coresight_enable_path+0x1c8/0x218 [coresight]<br /> coresight_enable_sysfs+0xa4/0x228 [coresight]<br /> enable_source_store+0x58/0xa8 [coresight]<br /> dev_attr_store+0x20/0x40<br /> sysfs_kf_write+0x4c/0x68<br /> kernfs_fop_write_iter+0x120/0x1b8<br /> vfs_write+0x2c8/0x388<br /> ksys_write+0x74/0x108<br /> __arm64_sys_write+0x24/0x38<br /> el0_svc_common.constprop.0+0x64/0x148<br /> do_el0_svc+0x24/0x38<br /> el0_svc+0x3c/0x130<br /> el0t_64_sync_handler+0xc8/0xd0<br /> el0t_64_sync+0x1ac/0x1b0<br /> ---[ end trace 0000000000000000 ]---<br /> <br /> Since the enablement of sysfs mode is separeted into two critical regions,<br /> one for sysfs buffer allocation and another for hardware enablement, it&amp;#39;s<br /> possible to race with the perf mode. Fix this by double check whether<br /> the perf mode&amp;#39;s been used before enabling the hardware in sysfs mode.<br /> <br /> mode:<br /> [sysfs mode] [perf mode]<br /> tmc_etr_get_sysfs_buffer()<br /> spin_lock(&amp;drvdata-&gt;spinlock)<br /> [sysfs buffer allocation]<br /> spin_unlock(&amp;drvdata-&gt;spinlock)<br /> spin_lock(&amp;drvdata-&gt;spinlock)<br /> tmc_etr_enable_hw()<br /> drvdata-&gt;etr_buf = etr_perf-&gt;etr_buf<br /> spin_unlock(&amp;drvdata-&gt;spinlock)<br /> spin_lock(&amp;drvdata-&gt;spinlock)<br /> tmc_etr_enable_hw()<br /> WARN_ON(drvdata-&gt;etr_buf) // WARN sicne etr_buf initialized at<br /> the perf side<br /> spin_unlock(&amp;drvdata-&gt;spinlock)<br /> <br /> With this fix, we retain the check for CS_MODE_PERF in get_etr_sysfs_buf.<br /> This ensures we verify whether the perf mode&amp;#39;s already running before we<br /> actually allocate the buffer. Then we can save the time of<br /> allocating/freeing the sysfs buffer if race with the perf mode.