In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/hugetlb: fix hugetlb cgroup rsvd charge\/uncharge mismatch<\/p>\n
In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd
\nand non-rsvd hugetlb cgroup charges. When map_chg is set,
\nhugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but
\nthe immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg
\nwith the non-rsvd cgroup pointer.<\/p>\n
As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
\n(non-rsvd) cgroup pointer into the folio’s rsvd slot.<\/p>\n
When the folio is later freed, free_huge_folio() unconditionally calls
\nboth hugetlb_cgroup_uncharge_folio() and
\nhugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back the
\nwrong cgroup from the folio and decrements a counter that was never
\ncharged for that cgroup, causing a page_counter underflow:<\/p>\n
page_counter underflow: -512 nr_pages=512
\n WARNING: mm\/page_counter.c:61 at page_counter_cancel<\/p>\n
Fix this by introducing a separate h_cg_rsvd pointer exclusively for the
\nrsvd charge path, keeping the rsvd and non-rsvd charges fully independent
\nthrough their charge, commit, and error uncharge paths.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/hugetlb: fix hugetlb cgroup rsvd charge\/uncharge mismatch<\/p>\n
In alloc_hugetlb_folio(), a single h_cg pointer is used for both the <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6842","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6842","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6842"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6842"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6842"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}