In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm: fix __vm_normal_page() to handle missing support for pmd_special()\/pud_special()<\/p>\n
On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a
\n“WARNING: mm\/memory.c:735 at __vm_normal_page+0x6a\/0x7d”, from the
\nVM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by
\n“BUG: Bad rss-counter state”s, then later “BUG: Bad page state”s when
\nreclaim gets to call shrink_huge_zero_folio_scan().<\/p>\n
It’s as if the _PAGE_SPECIAL bit never got set in the huge_zero pmd: and
\nindeed, whereas pte_special() and pte_mkspecial() are subject to a
\ndedicated CONFIG_ARCH_HAS_PTE_SPECIAL, pmd_special() and pmd_mkspecial()
\nare subject to CONFIG_ARCH_SUPPORTS_PMD_PFNMAP, which is never enabled on
\nany 32-bit architecture.<\/p>\n
While the problem was exposed through commit d80a9cb1a64a
\n(“mm\/huge_memory: add and use normal_or_softleaf_folio_pmd()”), it was an
\noversight in commit af38538801c6 (“mm\/memory: factor out common code from
\nvm_normal_page_*()”) and would result in other problems:
\n* huge zero folio accounted in smaps, pagemap (PAGE_IS_FILE) and
\n numamaps as file-backed THP
\n* folio_walk_start() returning the folio even without FW_ZEROPAGE set.
\n Callers seem to tolerate that, though.<\/p>\n
… and triggering the VM_WARN_ON_ONE(), although never reported so far.<\/p>\n
To fix it, teach vm_normal_page_pmd()\/vm_normal_page_pud() to consider
\nwhether pmd_special\/pud_special is actually implemented.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm: fix __vm_normal_page() to handle missing support for pmd_special()\/pud_special()<\/p>\n
On x86 32-bit with THP enabled, zap_huge_pmd(<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15115","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}