In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()<\/p>\n
syzbot reported a sleeping function called from invalid context splat in
\nbucket_table_alloc().<\/p>\n
When rhashtable_insert_slow() rehashes the table under rcu_read_lock(), it
\ncalls bucket_table_alloc(…, GFP_ATOMIC | __GFP_NOWARN). If the bucket
\ntable allocation uses vmalloc, __vmalloc_node_range_noprof() invokes
\nvm_area_alloc_pages() -> alloc_pages_bulk_mempolicy_noprof() with the
\npassed GFP_ATOMIC flags.<\/p>\n
If the current task has an MPOL_WEIGHTED_INTERLEAVE mempolicy,
\nalloc_pages_bulk_weighted_interleave() is called and currently hardcodes
\nGFP_KERNEL when allocating the temporary weights array, triggering a
\nmight_alloc() splat in atomic\/RCU contexts.<\/p>\n
Pass the gfp flags (masked with GFP_RECLAIM_MASK to strip page-allocator
\nzone modifiers like __GFP_HIGHMEM) received by
\nalloc_pages_bulk_weighted_interleave() to kmalloc() instead of hardcoding
\nGFP_KERNEL. Since the weights buffer is immediately initialized in full,
\nkmalloc() is sufficient.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()<\/p>\n
syzbot reported a sleeping function called from in<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24673","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24673","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24673"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24673"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}