In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()<\/p>\n
The mmap_prepare hook functionality includes the ability to invoke
\nmmap_prepare() from the mmap() hook of existing ‘stacked’ drivers, that is
\nones which are capable of calling the mmap hooks of other drivers\/file
\nsystems (e.g. overlayfs, shm).<\/p>\n
As part of the mmap_prepare action functionality, we deal with errors by
\nunmapping the VMA should one arise. This works in the usual mmap_prepare
\ncase, as we invoke this action at the last moment, when the VMA is
\nestablished in the maple tree.<\/p>\n
However, the mmap() hook passes a not-fully-established VMA pointer to the
\ncaller (which is the motivation behind the mmap_prepare() work), which is
\ndetached.<\/p>\n
So attempting to unmap a VMA in this state will be problematic, with the
\nmost obvious symptom being a warning in vma_mark_detached(), because the
\nVMA is already detached.<\/p>\n
It’s also unncessary – the mmap() handler will clean up the VMA on error.<\/p>\n
So to fix this issue, this patch propagates whether or not an mmap action
\nis being completed via the compatibility layer or directly.<\/p>\n
If the former, then we do not attempt VMA cleanup, if the latter, then we
\ndo.<\/p>\n
This patch also updates the userland VMA tests to reflect the change.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()<\/p>\n
The mmap_prepare hook functionality includes the ability t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14848","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}