In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/mempolicy: skip non-present PMDs when queueing folios<\/p>\n
Patch series “mm: handle device-private PMDs in walk callbacks”, v3.<\/p>\n
Since commit 368076f52ebe (“mm\/huge_memory: add device-private THP support
\nto PMD operations”) a PMD may hold a device-private swap entry whenever an
\nHMM-based GPU driver migrates an anonymous THP folio to device memory via
\nmigrate_vma_pages().<\/p>\n
pmd_trans_huge_lock() succeeds for such PMDs (pmd_is_huge() returns true
\nfor any non-present, non-none huge PMD), so several MM walk callbacks that
\nused to assume present THP or migration entry are now reachable with a
\ndevice-private PMD. The results range from a VM_BUG_ON() firing on debug
\nkernels, to an oops on a bogus vmemmap dereference, to silently isolating
\nan unrelated live folio from LRU in the aliasing case.<\/p>\n
This patch (of 3):<\/p>\n
queue_folios_pmd() is called under pmd_trans_huge_lock(), whose
\npmd_is_huge() check returns true for any non-present, non-none PMD
\nsoftleaf. Passing such a PMD to pmd_folio() treats the softleaf encoding
\nas a hardware PFN and can return a bogus folio pointer.<\/p>\n
Mirror queue_folios_pte_range(): handle non-present entries before looking
\nup a folio. Keep migration entries counted as failures, but skip other
\nnon-present PMDs such as device-private entries.<\/p>\n
Potential trigger: an HMM-based GPU driver migrates an anonymous THP folio
\nto device memory via migrate_vma_pages(), leaving a device-private PMD.
\nUserspace then calls mbind(), migrate_pages() or set_mempolicy_home_node()
\non that range.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/mempolicy: skip non-present PMDs when queueing folios<\/p>\n
Patch series “mm: handle device-private PMDs in walk callbacks”, v3.<\/p>\n
Sin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21680","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}