In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/hugetlb: fix list corruption in allocate_file_region_entries()<\/p>\n
allocate_file_region_entries() tops up resv->region_cache with freshly
\nallocated file_region descriptors. The allocation uses GFP_KERNEL, so
\nresv->lock is dropped around it: the new entries are gathered on a
\nstack-local list head, allocated_regions, and spliced into
\nresv->region_cache once the lock is re-acquired.<\/p>\n
The splice used list_splice(), which moves the entries but does not
\nre-initialize the source head, so allocated_regions is left pointing at an
\nentry that now lives on resv->region_cache. The top-up runs in a while
\nloop that re-checks the cache deficit after re-acquiring the lock. For a
\nshared mapping the resv_map is shared by every mapper of the hugetlbfs
\ninode, so a concurrent region_chg()\/region_add()\/region_del() on the same
\nresv_map can consume cache entries during the unlocked window and force a
\nsecond iteration. That iteration calls list_add() on the stale head and
\ncorrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check
\ntrips:<\/p>\n
list_add corruption. next->prev should be prev (ffffc900011ff7f8),
\n but was ffff88814c281460. (next=ffff88814c545640).
\n kernel BUG at lib\/list_debug.c:31!
\n allocate_file_region_entries+0x191\/0x420
\n region_chg+0x267\/0x300
\n hugetlb_reserve_pages+0x387\/0xc80
\n hugetlbfs_file_mmap+0x2ce\/0x3f0
\n mmap_region+0x1348\/0x1a80
\n do_mmap+0x85e\/0xb90
\n vm_mmap_pgoff+0x18c\/0x330
\n ksys_mmap_pgoff+0x2a1\/0x3e0
\n do_syscall_64+0xd7\/0x420<\/p>\n
Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack
\naddress into resv->region_cache, leading to later use-after-free.<\/p>\n
This was observed as a real host panic on a dense KVM host where a QEMU
\nguest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate
\nSPDK\/DPDK vhost-user target, generating concurrent region_* traffic on one
\nshared resv_map.<\/p>\n
Use list_splice_init() so the source head is re-initialized empty after
\neach splice, making the retry loop safe.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/hugetlb: fix list corruption in allocate_file_region_entries()<\/p>\n
allocate_file_region_entries() tops up resv->region_cache with f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7518","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7518"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7518"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}