Frederic Weisbecker

The Linux kernel has a vulnerability that can cause an event leak upon exec and file release. This occurs when the perf pending task work is never waited upon the matching event release, potentially resulting in a leaked event. The issue can be triggered in scenarios involving child events released via free event() directly, and can also happen with perf event remove on exec() or concurrent perf event release(). The fix involves synchronizing against the possibly remaining pending task work while freeing the event.

The issue arises when a task is scheduled out and pending sigtrap deliveries are deferred to the target task upon resume to userspace via task work. Failures while adding an event's callback to the task work engine are ignored, leading to a small window where pending sigtrap can be queued and ignored, causing an event refcount addition leak. This occurs in the following scenario: when a task exits, the last call for events exit happens after task work is closed, resulting in the event never being released. Technical details about exploitation include: - The `task work add()` function's error handling is inadequate, leading to the leak. - The `event->pending sigtrap` variable is used to track pending sigtrap deliveries. - The `irq work queue()` function is used to queue the pending IRQ. - The `perf event overflow()` function is involved in the scenario where the leak occurs. - The `event sched out()` function is called when the task is scheduled out. - The `perf pending irq()` function returns early when `event->oncpu` is -1.