In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/huge_memory: skip device-private PMDs in madvise_free_huge_pmd<\/p>\n
madvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then
\nmadvise_free_huge_pmd() takes pmd_trans_huge_lock(). pmd_is_huge()
\nreturns true for a device-private PMD, so orig_pmd can be device-private
\nand enter the !pmd_present() branch.<\/p>\n
Skip device-private PMDs in that non-present branch and continue to out
\nbefore calling pmd_folio(). Downgrade the check to VM_WARN_ON_ONCE() so
\nan unexpected PMD softleaf logs a warning rather than panicking. Drop the
\nthp_migration_supported() guard: it expands to
\nIS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both
\npmd_is_migration_entry() and pmd_is_device_private_entry() already return
\nfalse when that config is not selected, so the guard suppresses only the
\ncase where the warning would already be silent.<\/p>\n
Potential trigger: an HMM-based GPU driver races with madvise(MADV_FREE):
\nmigrate_vma_pages() flips the PMD to a device-private entry between the
\ncaller’s pmd_trans_huge() check and the callee’s pmd_trans_huge_lock().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/huge_memory: skip device-private PMDs in madvise_free_huge_pmd<\/p>\n
madvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28482","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}