Skip to content
OpenAdvisories
Unscored CVE-2023-53583 EUVD-2025-32303GHSA-fr5x-v6h2-7cvx

perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start()

Published Oct 4, 2025 · Updated May 11, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start()

Since commit 096b52fd2bb4 ("perf: RISC-V: throttle perf events") the
perf_sample_event_took() function was added to report time spent in
overflow interrupts. If the interrupt takes too long, the perf framework
will lower the sysctl_perf_event_sample_rate and max_samples_per_tick.
When hwc->interrupts is larger than max_samples_per_tick, the
hwc->interrupts will be set to MAX_INTERRUPTS, and events will be
throttled within the __perf_event_account_interrupt() function.

However, the RISC-V PMU driver doesn't call riscv_pmu_stop() to update the
PERF_HES_STOPPED flag after perf_event_overflow() in pmu_sbi_ovf_handler()
function to avoid throttling. When the perf framework unthrottled the event
in the timer interrupt handler, it triggers riscv_pmu_start() function
and causes a WARN_ON_ONCE() warning, as shown below:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 240 at drivers/perf/riscv_pmu.c:184 riscv_pmu_start+0x7c/0x8e
Modules linked in:
CPU: 0 PID: 240 Comm: ls Not tainted 6.4-rc4-g19d0788e9ef2 #1
Hardware name: SiFive (DT)
epc : riscv_pmu_start+0x7c/0x8e
ra : riscv_pmu_start+0x28/0x8e
epc : ffffffff80aef864 ra : ffffffff80aef810 sp : ffff8f80004db6f0
gp : ffffffff81c83750 tp : ffffaf80069f9bc0 t0 : ffff8f80004db6c0
t1 : 0000000000000000 t2 : 000000000000001f s0 : ffff8f80004db720
s1 : ffffaf8008ca1068 a0 : 0000ffffffffffff a1 : 0000000000000000
a2 : 0000000000000001 a3 : 0000000000000870 a4 : 0000000000000000
a5 : 0000000000000000 a6 : 0000000000000840 a7 : 0000000000000030
s2 : 0000000000000000 s3 : ffffaf8005165800 s4 : ffffaf800424da00
s5 : ffffffffffffffff s6 : ffffffff81cc7590 s7 : 0000000000000000
s8 : 0000000000000006 s9 : 0000000000000001 s10: ffffaf807efbc340
s11: ffffaf807efbbf00 t3 : ffffaf8006a16028 t4 : 00000000dbfbb796
t5 : 0000000700000000 t6 : ffffaf8005269870
status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003
[<ffffffff80aef864>] riscv_pmu_start+0x7c/0x8e
[<ffffffff80185b56>] perf_adjust_freq_unthr_context+0x15e/0x174
[<ffffffff80188642>] perf_event_task_tick+0x88/0x9c
[<ffffffff800626a8>] scheduler_tick+0xfe/0x27c
[<ffffffff800b5640>] update_process_times+0x9a/0xba
[<ffffffff800c5bd4>] tick_sched_handle+0x32/0x66
[<ffffffff800c5e0c>] tick_sched_timer+0x64/0xb0
[<ffffffff800b5e50>] __hrtimer_run_queues+0x156/0x2f4
[<ffffffff800b6bdc>] hrtimer_interrupt+0xe2/0x1fe
[<ffffffff80acc9e8>] riscv_timer_interrupt+0x38/0x42
[<ffffffff80090a16>] handle_percpu_devid_irq+0x90/0x1d2
[<ffffffff8008a9f4>] generic_handle_domain_irq+0x28/0x36

After referring other PMU drivers like Arm, Loongarch, Csky, and Mips,
they don't call *_pmu_stop() to update with PERF_HES_STOPPED flag
after perf_event_overflow() function nor do they add PERF_HES_STOPPED
flag checking in *_pmu_start() which don't cause this warning.

Thus, it's recommended to remove this unnecessary check in
riscv_pmu_start() function to prevent this warning.

Affected products

VendorProductAffectedFixed
Linux Linux 6.1 6.1.40

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.4.11-1 —
Debian 13 linux 6.4.11-1 —
Debian 12 linux 6.1.52-1 —
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS linux-intel +9 No fix yet —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +6 6.4.0-150700.53.22.1 SUSE-SU-2025:4057-1
SLES 15 SP7 kernel-azure +2 6.4.0-150700.20.18.1 SUSE-SU-2025:4132-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.22.1.150700.17.15.1 SUSE-SU-2025:4057-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.78.1 SUSE-SU-2025:4140-1
SLES 15 SP6 kernel-azure +2 6.4.0-150600.8.55.1 SUSE-SU-2025:4128-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.78.1.150600.12.34.2 SUSE-SU-2025:4140-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 kernel-default-base 6.4.0-36.1.21.13 SUSE-SU-2025:21056-1
SLE Micro 6.1 kernel-rt +1 6.4.0-38.1 SUSE-SU-2025:21064-1
SLE Micro 6.1 kernel-source +2 6.4.0-36.1 SUSE-SU-2025:21056-1
SLE Micro 6.0 kernel-default-base 6.4.0-36.1.21.13 SUSE-SU-2025:21040-1
SLE Micro 6.0 kernel-rt +1 6.4.0-38.1 SUSE-SU-2025:21052-1
SLE Micro 6.0 kernel-source +2 6.4.0-36.1 SUSE-SU-2025:21040-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.22.1 SUSE-SU-2025:4057-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_6 1-150700.1.3.1 SUSE-SU-2025:4141-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_6 1-150700.15.3.1 SUSE-SU-2025:4057-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.78.1 SUSE-SU-2025:4140-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_17 1-150600.1.3.1 SUSE-SU-2025:4301-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_17 1-150600.13.5.1 SUSE-SU-2025:4140-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.22.1 SUSE-SU-2025:4141-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.58.1 SUSE-SU-2025:4301-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +10 6.4.0-150600.23.78.1 SUSE-SU-2025:4140-1
openSUSE Leap 15.6 kernel-azure +2 6.4.0-150600.8.55.1 SUSE-SU-2025:4128-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.78.1.150600.12.34.2 SUSE-SU-2025:4140-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.58.1 SUSE-SU-2025:4301-1

Advisories 11

References