CVE-2022-49081
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49081
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49081.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49081
- Downstream
- Published
- 2025-02-26T01:54:41Z
- Modified
- 2025-10-15T18:44:59.066889Z
- Summary
- highmem: fix checks in __kmap_local_sched_{in,out}
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
highmem: fix checks in _kmaplocalsched{in,out}
When CONFIGDEBUGKMAPLOCAL is enabled _kmaplocalsched{in,out} check that even slots in the tsk->kmapctrl.pteval are unmapped. The slots are initialized with 0 value, but the check is done with ptenone. 0 pte however does not necessarily mean that ptenone will return true. e.g. on xtensa it returns false, resulting in the following runtime warnings:
WARNING: CPU: 0 PID: 101 at mm/highmem.c:627 _kmaplocalschedout+0x51/0x108 CPU: 0 PID: 101 Comm: touch Not tainted 5.17.0-rc7-00010-gd3a1cdde80d2-dirty #13 Call Trace: dumpstack+0xc/0x40 _warn+0x8f/0x174 warnslowpathfmt+0x48/0xac _kmaplocalschedout+0x51/0x108 _schedule+0x71a/0x9c4 preemptscheduleirq+0xa0/0xe0 commonexceptionreturn+0x5c/0x93 dowppage+0x30e/0x330 handlemmfault+0xa70/0xc3c dopagefault+0x1d8/0x3c4 commonexception+0x7f/0x7f
WARNING: CPU: 0 PID: 101 at mm/highmem.c:664 _kmaplocalschedin+0x50/0xe0 CPU: 0 PID: 101 Comm: touch Tainted: G W 5.17.0-rc7-00010-gd3a1cdde80d2-dirty #13 Call Trace: dumpstack+0xc/0x40 _warn+0x8f/0x174 warnslowpathfmt+0x48/0xac _kmaplocalschedin+0x50/0xe0 finishtaskswitch$isra$0+0x1ce/0x2f8 _schedule+0x86e/0x9c4 preemptscheduleirq+0xa0/0xe0 commonexceptionreturn+0x5c/0x93 dowppage+0x30e/0x330 handlemmfault+0xa70/0xc3c dopagefault+0x1d8/0x3c4 commonexception+0x7f/0x7f
Fix it by replacing !ptenone(pteval) with pteval(pteval) != 0.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/66f133ceab7456c789f70a242991ed1b27ba1c3d
- https://git.kernel.org/stable/c/7dd5b3b97716a611fcf67d92fd2370fcb8d50372
- https://git.kernel.org/stable/c/85550b0f5fa5dd3c30469ea702c44444ef242c83
- https://git.kernel.org/stable/c/c21d040de6225414547d9bd31cd200f290991c85
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5fbda3ecd14a5343644979c98d6eb65b7e7de9d8Fixedc21d040de6225414547d9bd31cd200f290991c85
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5fbda3ecd14a5343644979c98d6eb65b7e7de9d8Fixed85550b0f5fa5dd3c30469ea702c44444ef242c83
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5fbda3ecd14a5343644979c98d6eb65b7e7de9d8Fixed7dd5b3b97716a611fcf67d92fd2370fcb8d50372
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5fbda3ecd14a5343644979c98d6eb65b7e7de9d8Fixed66f133ceab7456c789f70a242991ed1b27ba1c3d