In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/dmem: fix callocated underflow on large folio split<\/p>\n
nouveau_dmem_folio_free() drops chunk->callocated once per freed folio,
\nwhile a large (compound) device-private folio is only counted once when
\nit is allocated. When such a folio is split, the mm core invokes
\n->folio_split() (nouveau_dmem_folio_split()) once for each new
\nsub-folio, but the hook only fixes up the sub-folio metadata and leaves
\nchunk->callocated unchanged.<\/p>\n
Each resulting sub-folio is later freed separately, so after a split
\nthe single allocation (+1) is met by N frees (-N), leaving
\nchunk->callocated short by N-1. On the first split\/free cycle it
\nunderflows: WARN_ON(!chunk->callocated) fires, the unsigned counter
\nwraps and never returns to zero, so the chunk can no longer be
\nreclaimed (nouveau_dmem_fini() also warns on the leaked count).<\/p>\n
Account for the new sub-folio in the split hook, under the same lock as
\nnouveau_dmem_folio_free(), so the count stays balanced.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/nouveau\/dmem: fix callocated underflow on large folio split<\/p>\n
nouveau_dmem_folio_free() drops chunk->callocated once per freed f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28497","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}