In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn<\/p>\n
With CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone()
\ninitializes struct pages early in boot to satisfy an allocation.<\/p>\n
With a large CMA reservation in place, the ranges deferred_init_memmap()
\nfinds may not add up to the allocation it was asked for, and the function
\nends up initializing the memory map of the entire zone and still falls
\nshort.<\/p>\n
That is fine in itself: the function accounts for it and leaves the
\ncaller to decide whether it now has enough memory.<\/p>\n
However, the update of pgdat->first_deferred_pfn that tracks where
\nuninitialized memory map starts could overflow.<\/p>\n
If the node’s RAM end is not aligned on PAGES_PER_SECTION boundaries and
\nsome deferred struct pages were initialized, pgdat->first_deferred_pfn
\nwould point past the end of the node’s memory.<\/p>\n
deferred_init_memmap() later picks up from pgdat->first_deferred_pfn and
\nhits a BUG_ON(), because it expects a pfn within its node.<\/p>\n
For example, when running a kernel with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
\nand CONFIG_CMA=y using the following qemu command line<\/p>\n
qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage
\n -append “nokaslr cma=4768M@0x100000000”<\/p>\n
the kernel panics:<\/p>\n
kernel BUG at mm\/mm_init.c:2131!
\n CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1
\n RIP: 0010:deferred_init_memmap+0x1b8\/0x1c0
\n RAX: 0000000000236000 R13: 0000000000238000
\n Call Trace:
\n kthread+0xdf\/0x120
\n ret_from_fork+0x187\/0x250<\/p>\n
Make sure that the update of pgdta->first_deferred_pfn does not overflow
\nwhen the entire zone’s (and therefore node’s) memory map is initialized.<\/p>\n
[rppt: massaged the changelog]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn<\/p>\n
With CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28491","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}