| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-42241: mm/shmem: disable PMD-sized page cache if needed |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| mm/shmem: disable PMD-sized page cache if needed |
| |
| For shmem files, it's possible that PMD-sized page cache can't be |
| supported by xarray. For example, 512MB page cache on ARM64 when the base |
| page size is 64KB can't be supported by xarray. It leads to errors as the |
| following messages indicate when this sort of xarray entry is split. |
| |
| WARNING: CPU: 34 PID: 7578 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 |
| Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 \ |
| nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject \ |
| nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ |
| ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm fuse xfs \ |
| libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_net \ |
| net_failover virtio_console virtio_blk failover dimlib virtio_mmio |
| CPU: 34 PID: 7578 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #9 |
| Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 |
| pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) |
| pc : xas_split_alloc+0xf8/0x128 |
| lr : split_huge_page_to_list_to_order+0x1c4/0x720 |
| sp : ffff8000882af5f0 |
| x29: ffff8000882af5f0 x28: ffff8000882af650 x27: ffff8000882af768 |
| x26: 0000000000000cc0 x25: 000000000000000d x24: ffff00010625b858 |
| x23: ffff8000882af650 x22: ffffffdfc0900000 x21: 0000000000000000 |
| x20: 0000000000000000 x19: ffffffdfc0900000 x18: 0000000000000000 |
| x17: 0000000000000000 x16: 0000018000000000 x15: 52f8004000000000 |
| x14: 0000e00000000000 x13: 0000000000002000 x12: 0000000000000020 |
| x11: 52f8000000000000 x10: 52f8e1c0ffff6000 x9 : ffffbeb9619a681c |
| x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff00010b02ddb0 |
| x5 : ffffbeb96395e378 x4 : 0000000000000000 x3 : 0000000000000cc0 |
| x2 : 000000000000000d x1 : 000000000000000c x0 : 0000000000000000 |
| Call trace: |
| xas_split_alloc+0xf8/0x128 |
| split_huge_page_to_list_to_order+0x1c4/0x720 |
| truncate_inode_partial_folio+0xdc/0x160 |
| shmem_undo_range+0x2bc/0x6a8 |
| shmem_fallocate+0x134/0x430 |
| vfs_fallocate+0x124/0x2e8 |
| ksys_fallocate+0x4c/0xa0 |
| __arm64_sys_fallocate+0x24/0x38 |
| invoke_syscall.constprop.0+0x7c/0xd8 |
| do_el0_svc+0xb4/0xd0 |
| el0_svc+0x44/0x1d8 |
| el0t_64_sync_handler+0x134/0x150 |
| el0t_64_sync+0x17c/0x180 |
| |
| Fix it by disabling PMD-sized page cache when HPAGE_PMD_ORDER is larger |
| than MAX_PAGECACHE_ORDER. As Matthew Wilcox pointed, the page cache in a |
| shmem file isn't represented by a multi-index entry and doesn't have this |
| limitation when the xarry entry is split until commit 6b24ca4a1a8d ("mm: |
| Use multi-index entries in the page cache"). |
| |
| The Linux kernel CVE team has assigned CVE-2024-42241 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 6.6.41 with commit 93893eacb372b0a4a30f7de6609b08c3ba6c4fd9 |
| Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 6.9.10 with commit cd25208ca9b0097f8e079d692fc678f36fdbc3f9 |
| Issue introduced in 5.17 with commit 6b24ca4a1a8d4ee3221d6d44ddbb99f542e4bda3 and fixed in 6.10 with commit 9fd154ba926b34c833b7bfc4c14ee2e931b3d743 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-42241 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| mm/shmem.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/93893eacb372b0a4a30f7de6609b08c3ba6c4fd9 |
| https://git.kernel.org/stable/c/cd25208ca9b0097f8e079d692fc678f36fdbc3f9 |
| https://git.kernel.org/stable/c/9fd154ba926b34c833b7bfc4c14ee2e931b3d743 |
