From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46AEF1FA26D for ; Mon, 21 Oct 2024 20:13:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729541587; cv=none; b=PiFashjYMBtKwg91D9UWZ3HvHIlFWLuVL86M+nthW3P5Y6nI787hw/l2ODHT6XRtYdV31x4ffrZr7Ja8gq+1EtDc4PBecBU/XNRIT+nr9Kxfh2XGyGk7My+FpHgOLQzaO8mJ0SXr7U8g7Op3T/Co5HK0i61ONhBv0R6OXwXS0WI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729541587; c=relaxed/simple; bh=aMiC8zXCnKUh8VMSO4A1E6G0evSLLAo3CLikGTEqnqo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Gz+vrrP4GQ4pTCWF1Wi93Pc3PyN82hiLXQgytYZPN0ZUo2MGV8QZtgzKRo/yCyWAGJfdVkcCWeW6/eCttpNzBCmGWBx6jex0xFmN6I19Q7IBaBmN0jnloo1fAerSIBfWXDgD96DR4r31fKE1AtFUL9cls2DK0tcvfY0tIVKSW6o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OOgZc0K6; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="OOgZc0K6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BFBF9C4CEC3; Mon, 21 Oct 2024 20:13:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1729541587; bh=aMiC8zXCnKUh8VMSO4A1E6G0evSLLAo3CLikGTEqnqo=; h=From:To:Cc:Subject:Date:Reply-to:From; b=OOgZc0K6BVnDcpVvyqXgPJnWqte5oq6KeiGfqXQFhZiLh5C0eYpLPdFuStmmOX8ya E8v3aHFH4HyKznEzaEtGgI6FIEICPZ/lgXy1ufkYuoOmcIQIlecSRR0A4rzeYXT2cb v86N2oehmGqncQDbovC7r4ArT9RhI/Hji4IKAMPs= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-48986: mm/gup: fix gup_pud_range() for dax Date: Mon, 21 Oct 2024 22:06:18 +0200 Message-ID: <2024102147-CVE-2022-48986-cd7d@gregkh> X-Mailer: git-send-email 2.47.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3847; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=aMiC8zXCnKUh8VMSO4A1E6G0evSLLAo3CLikGTEqnqo=; b=owGbwMvMwCRo6H6F97bub03G02pJDOliW6RVWLVN9uz+Wuu9+W9qy5ytWhfTIu0ZI8/u2nTA+ r7PS7+tHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRF1wM8xMeHJ1xZ3meX0bq 0mWJq4uuHnjXXMMwV+7BwnOpz7+1L/eVy/J29vl5O/WKFgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix gup_pud_range() for dax For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well. This fixes the below kernel panic: general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0 ? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be < snip > ---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 < snip > Kernel panic - not syncing: Fatal exception Kernel Offset: disabled The Linux kernel CVE team has assigned CVE-2022-48986 to this issue. Affected and fixed versions =========================== Issue introduced in 5.0 with commit 414fd080d125 and fixed in 5.4.227 with commit 04edfa3dc06e Issue introduced in 5.0 with commit 414fd080d125 and fixed in 5.10.159 with commit f1cf856123ce Issue introduced in 5.0 with commit 414fd080d125 and fixed in 5.15.83 with commit 3ac29732a2ff Issue introduced in 5.0 with commit 414fd080d125 and fixed in 6.0.13 with commit e06d13c36ded Issue introduced in 5.0 with commit 414fd080d125 and fixed in 6.1 with commit fcd0ccd836ff Issue introduced in 4.9.165 with commit c133d8eb894c Issue introduced in 4.14.108 with commit 538162d21ac8 Issue introduced in 4.19.31 with commit 8b1a7762e0da Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48986 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: mm/gup.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/04edfa3dc06ecfc6133a33bc7271298782dee875 https://git.kernel.org/stable/c/f1cf856123ceb766c49967ec79b841030fa1741f https://git.kernel.org/stable/c/3ac29732a2ffa64c7de13a072b0f2848b9c11037 https://git.kernel.org/stable/c/e06d13c36ded750c72521b600293befebb4e56c5 https://git.kernel.org/stable/c/fcd0ccd836ffad73d98a66f6fea7b16f735ea920