In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages<\/p>\n
Patch series “mm: Refactor bootmem gigantic hugepage allocation”, v4.<\/p>\n
This series is split out from the earlier larger series “mm: Generalize
\nHVO for HugeTLB and device DAX” [1]. It collects the first 19 patches of
\nthat series as a standalone set of fixes and preparatory cleanups around
\nbootmem HugeTLB handling, sparse initialization ordering, and related
\nvmemmap setup.<\/p>\n
The first patches fix a few bugs found while reviewing the existing code,
\nincluding incorrect bootmem HVO handling, wrong vmemmap registration
\narguments, a powerpc compound-vmemmap tracking bug, and too-late
\ninitialization of gigantic bootmem HugeTLB struct pages.<\/p>\n
The rest of the series reorders early memory initialization so the
\nrelevant zone state is available before sparse and HugeTLB boot-time setup
\nruns, then simplifies the remaining bootmem gigantic hugepage allocation
\npath and removes code made obsolete by that rework.<\/p>\n
At a high level:
\n – patches [1-4] fix boot-time and arch-specific bugs
\n – patches [5-12] reorder and simplify sparse\/mm\/hugetlb early init
\n – patches [13-19] refactor bootmem gigantic hugepage allocation and
\n remove obsolete helpers and state<\/p>\n
This patch (of 19):<\/p>\n
Commit 622026e87c40 (“mm\/hugetlb: remove fake head pages”) switched
\nHVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].<\/p>\n
Those shared tail pages were initialized in hugetlb_vmemmap_init(), but
\nbootmem HugeTLB folios are prepared earlier from
\ngather_bootmem_prealloc(). With hugetlb_free_vmemmap=on,
\nprep_and_add_bootmem_folios() can access pageblock flags on bootmem
\nHugeTLB pages whose mirrored tail struct pages already point to the shared
\ntail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then
\ndereferences the still-uninitialized shared tail page and can panic during
\nboot.<\/p>\n
Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before
\nbootmem HugeTLB folios are processed, and drop the later initialization
\nfrom hugetlb_vmemmap_init().<\/p>\n
This bug only affects CONFIG_DEBUG_VM kernels, where the relevant
\nassertion is evaluated.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages<\/p>\n
Patch series “mm: Refactor bootmem gigantic hugepage allocat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28496","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}