| From bippy-1.0.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-44943: mm: gup: stop abusing try_grab_folio |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| mm: gup: stop abusing try_grab_folio |
| |
| A kernel warning was reported when pinning folio in CMA memory when |
| launching SEV virtual machine. The splat looks like: |
| |
| [ 464.325306] WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313 __get_user_pages+0x423/0x520 |
| [ 464.325464] CPU: 13 PID: 6734 Comm: qemu-kvm Kdump: loaded Not tainted 6.6.33+ #6 |
| [ 464.325477] RIP: 0010:__get_user_pages+0x423/0x520 |
| [ 464.325515] Call Trace: |
| [ 464.325520] <TASK> |
| [ 464.325523] ? __get_user_pages+0x423/0x520 |
| [ 464.325528] ? __warn+0x81/0x130 |
| [ 464.325536] ? __get_user_pages+0x423/0x520 |
| [ 464.325541] ? report_bug+0x171/0x1a0 |
| [ 464.325549] ? handle_bug+0x3c/0x70 |
| [ 464.325554] ? exc_invalid_op+0x17/0x70 |
| [ 464.325558] ? asm_exc_invalid_op+0x1a/0x20 |
| [ 464.325567] ? __get_user_pages+0x423/0x520 |
| [ 464.325575] __gup_longterm_locked+0x212/0x7a0 |
| [ 464.325583] internal_get_user_pages_fast+0xfb/0x190 |
| [ 464.325590] pin_user_pages_fast+0x47/0x60 |
| [ 464.325598] sev_pin_memory+0xca/0x170 [kvm_amd] |
| [ 464.325616] sev_mem_enc_register_region+0x81/0x130 [kvm_amd] |
| |
| Per the analysis done by yangge, when starting the SEV virtual machine, it |
| will call pin_user_pages_fast(..., FOLL_LONGTERM, ...) to pin the memory. |
| But the page is in CMA area, so fast GUP will fail then fallback to the |
| slow path due to the longterm pinnalbe check in try_grab_folio(). |
| |
| The slow path will try to pin the pages then migrate them out of CMA area. |
| But the slow path also uses try_grab_folio() to pin the page, it will |
| also fail due to the same check then the above warning is triggered. |
| |
| In addition, the try_grab_folio() is supposed to be used in fast path and |
| it elevates folio refcount by using add ref unless zero. We are guaranteed |
| to have at least one stable reference in slow path, so the simple atomic add |
| could be used. The performance difference should be trivial, but the |
| misuse may be confusing and misleading. |
| |
| Redefined try_grab_folio() to try_grab_folio_fast(), and try_grab_page() |
| to try_grab_folio(), and use them in the proper paths. This solves both |
| the abuse and the kernel warning. |
| |
| The proper naming makes their usecase more clear and should prevent from |
| abusing in the future. |
| |
| peterx said: |
| |
| : The user will see the pin fails, for gpu-slow it further triggers the WARN |
| : right below that failure (as in the original report): |
| : |
| : folio = try_grab_folio(page, page_increm - 1, |
| : foll_flags); |
| : if (WARN_ON_ONCE(!folio)) { <------------------------ here |
| : /* |
| : * Release the 1st page ref if the |
| : * folio is problematic, fail hard. |
| : */ |
| : gup_put_folio(page_folio(page), 1, |
| : foll_flags); |
| : ret = -EFAULT; |
| : goto out; |
| : } |
| |
| [1] https://lore.kernel.org/linux-mm/1719478388-31917-1-git-send-email-yangge1116@126.com/ |
| |
| [shy828301@gmail.com: fix implicit declaration of function try_grab_folio_fast] |
| |
| The Linux kernel CVE team has assigned CVE-2024-44943 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.6 with commit 57edfcfd3419b4799353d8cbd6ce49da075cfdbd and fixed in 6.6.47 with commit 26273f5f4cf68b29414e403837093408a9c98e1f |
| Issue introduced in 6.6 with commit 57edfcfd3419b4799353d8cbd6ce49da075cfdbd and fixed in 6.10 with commit f442fa6141379a20b48ae3efabee827a3d260787 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-44943 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| mm/gup.c |
| mm/huge_memory.c |
| mm/internal.h |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/26273f5f4cf68b29414e403837093408a9c98e1f |
| https://git.kernel.org/stable/c/f442fa6141379a20b48ae3efabee827a3d260787 |
