From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9239B21B195 for ; Wed, 26 Feb 2025 02:24:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536699; cv=none; b=EwomQdi/Pgr4OfFs1SgOTO+rL9P1xXJb+aAOJ9x69s8HisnvoxNCLthpZRZ+oXGs4g/O2QMVWl260a1MT6EDTk/bozT9PH4ryM64AqGucfZEvDYFG2DasKJ/m4wy/swyqjbukC1o/lof7kPMbkLK0L2+zLs8EbuEcD7LhWLfgl4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536699; c=relaxed/simple; bh=MbJNa0jeG4hj+T+e5j5GZpmiDxfpEWKhD58TjmVCRRk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nyB+ch081Xh18F43xxxnikJeyihfvMyKrqS7Oh3ojWX6aCEytvT5rmEsP6ZOLJG6n5qRJxk6VAPikft16h+2kiQ4WC3snMM4mOsizW89wlOfLpeELeTYNg9HtnxXc5fvMe7bUV4fhDKkKEkmLDiZbQ+u66MrE91iSLpjf5GSzs4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jbCeNxur; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jbCeNxur" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66784C4CEDD; Wed, 26 Feb 2025 02:24:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536699; bh=MbJNa0jeG4hj+T+e5j5GZpmiDxfpEWKhD58TjmVCRRk=; h=From:To:Cc:Subject:Date:Reply-to:From; b=jbCeNxuriy1Gg+JtTefUzSDCLuIHE9QmdA1cLU40Duw9WYLhuB4ObRqg0WhMjibq8 s9rfYvDN57raOjriP8AIB6fSomM55ZcHS1ojgMdXhl9hElcnGmOxXAprZW4YqIjA1k UzdrwQMirmQuZTbrGiemxKBPVFE9ydhjjL9XrIzo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49666: powerpc/memhotplug: Add add_pages override for PPC Date: Wed, 26 Feb 2025 03:23:49 +0100 Message-ID: <2025022623-CVE-2022-49666-98ab@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4076; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=MbJNa0jeG4hj+T+e5j5GZpmiDxfpEWKhD58TjmVCRRk=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7qu5PuvlD94gT94E97bqhRQzmMv9zHBd8D3N8bfpNw bHZ9e+hjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIrwqG+R7hT+2P/UnIY2eT 0fglu4/rTMW+owwLNkRe7S0yDA6Oa+H5ft794tar8hJrAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: powerpc/memhotplug: Add add_pages override for PPC With commit ffa0b64e3be5 ("powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit") the kernel now validate the addr against high_memory value. This results in the below BUG_ON with dax pfns. [ 635.798741][T26531] kernel BUG at mm/page_alloc.c:5521! 1:mon> e cpu 0x1: Vector: 700 (Program Check) at [c000000007287630] pc: c00000000055ed48: free_pages.part.0+0x48/0x110 lr: c00000000053ca70: tlb_finish_mmu+0x80/0xd0 sp: c0000000072878d0 msr: 800000000282b033 current = 0xc00000000afabe00 paca = 0xc00000037ffff300 irqmask: 0x03 irq_happened: 0x05 pid = 26531, comm = 50-landscape-sy kernel BUG at :5521! Linux version 5.19.0-rc3-14659-g4ec05be7c2e1 (kvaneesh@ltc-boston8) (gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #625 SMP Thu Jun 23 00:35:43 CDT 2022 1:mon> t [link register ] c00000000053ca70 tlb_finish_mmu+0x80/0xd0 [c0000000072878d0] c00000000053ca54 tlb_finish_mmu+0x64/0xd0 (unreliable) [c000000007287900] c000000000539424 exit_mmap+0xe4/0x2a0 [c0000000072879e0] c00000000019fc1c mmput+0xcc/0x210 [c000000007287a20] c000000000629230 begin_new_exec+0x5e0/0xf40 [c000000007287ae0] c00000000070b3cc load_elf_binary+0x3ac/0x1e00 [c000000007287c10] c000000000627af0 bprm_execve+0x3b0/0xaf0 [c000000007287cd0] c000000000628414 do_execveat_common.isra.0+0x1e4/0x310 [c000000007287d80] c00000000062858c sys_execve+0x4c/0x60 [c000000007287db0] c00000000002c1b0 system_call_exception+0x160/0x2c0 [c000000007287e10] c00000000000c53c system_call_common+0xec/0x250 The fix is to make sure we update high_memory on memory hotplug. This is similar to what x86 does in commit 3072e413e305 ("mm/memory_hotplug: introduce add_pages") The Linux kernel CVE team has assigned CVE-2022-49666 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15.34 with commit fddb88bd266f4513abab7c36bca98935c9148a98 and fixed in 5.15.53 with commit 89296ac435e2cf8a5101f7fab8f0c7b754b92052 Issue introduced in 5.18 with commit ffa0b64e3be58519ae472ea29a1a1ad681e32f48 and fixed in 5.18.10 with commit 84d146fd35a01b08e9515041de60f0f915a417d5 Issue introduced in 5.18 with commit ffa0b64e3be58519ae472ea29a1a1ad681e32f48 and fixed in 5.19 with commit ac790d09885d36143076e7e02825c541e8eee899 Issue introduced in 5.4.190 with commit deab81144d5a043f42804207fb76cfbd8a806978 Issue introduced in 5.10.111 with commit d36febbcd537fcc50284e8b89609632d0146529f Issue introduced in 5.16.20 with commit a3727c25eacd7e437c4f560957fa3a376fe93e6b Issue introduced in 5.17.3 with commit cbc065efcba000ad8f615f506ebe61b6d3c5145b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49666 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/powerpc/Kconfig arch/powerpc/mm/mem.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/89296ac435e2cf8a5101f7fab8f0c7b754b92052 https://git.kernel.org/stable/c/84d146fd35a01b08e9515041de60f0f915a417d5 https://git.kernel.org/stable/c/ac790d09885d36143076e7e02825c541e8eee899