In the Linux kernel, the following vulnerability has been resolved:
mm: hugetlb: independent PMD page table shared count
The folio refcount may be increased unexpectly through trygetfolio() by caller such as splithugepages. In hugepmdunshare(), we use refcount to check whether a pmd page table is shared. The check is incorrect if the refcount is increased by the above caller, and this can cause the page table leaked:
BUG: Bad page state in process sh pfn:109324 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324 flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff) pagetype: f2(table) raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000 raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000 page dumped because: nonzero mapcount ... CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G B 6.13.0-rc2master+ #7 Tainted: [B]=BADPAGE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: showstack+0x20/0x38 (C) dumpstacklvl+0x80/0xf8 dumpstack+0x18/0x28 badpage+0x8c/0x130 freepageisbadreport+0xa4/0xb0 freeunrefpage+0x3cc/0x620 _folioput+0xf4/0x158 splithugepagesall+0x1e0/0x3e8 splithugepageswrite+0x25c/0x2d8 fullproxywrite+0x64/0xd8 vfswrite+0xcc/0x280 ksyswrite+0x70/0x110 _arm64syswrite+0x24/0x38 invokesyscall+0x50/0x120 el0svccommon.constprop.0+0xc8/0xf0 doel0svc+0x24/0x38 el0svc+0x34/0x128 el0t64synchandler+0xc8/0xd0 el0t64_sync+0x190/0x198
The issue may be triggered by damon, offlinepage, pageidle, etc, which will increase the refcount of page table.
The page table itself will be discarded after reporting the "nonzero mapcount".
The HugeTLB page mapped by the page table miss freeing since we treat the page table as shared and a shared page table will not be unmapped.
Fix it by introducing independent PMD page table shared count. As described by comment, ptindex/ptmm/ptfragrefcount are used for s390 gmap, x86 pgds and powerpc, ptsharecount is used for x86/arm64/riscv pmds, so we can reuse the field as ptsharecount.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59d9094df3d79443937add8700b2ef1a866b1081",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241984197564115567285268710434833730930",
"42241276663333915754760607243291358075",
"100394944923470798433535377080939513543",
"272288672805085525595295693591529254571"
]
},
"id": "CVE-2024-57883-0e9a91cf",
"signature_type": "Line",
"target": {
"file": "include/linux/mm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e31443a0d18ae43b9d29e02bf0563f07772193d",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52232912709650045397853783435819886549",
"123858457902006965935407888641844021343",
"63572277096252519616758852251449094009",
"276107308515881798255681671966928263442",
"101737720647050889506124660692884311529",
"234970968954747603698716456029417191718",
"109109676721269248060219807572705305148",
"37745504813731782619235465594061101161",
"152098064935390275929718322195679383543",
"216583128467915004541404730811177181358"
]
},
"id": "CVE-2024-57883-1bb33359",
"signature_type": "Line",
"target": {
"file": "include/linux/mm_types.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234843866071468673131104843032855415385",
"74194105845553126809750992953844342166",
"113763124004523939361845598235203559719",
"123257141803159560876203994930573005313"
]
},
"id": "CVE-2024-57883-226ca119",
"signature_type": "Line",
"target": {
"file": "include/linux/mm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59d9094df3d79443937add8700b2ef1a866b1081",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253291055723695488000156452098876199914",
"122684493009316058816140542009108408072",
"327282355790333758278258982439403745058",
"199656671783941939235682972782469307028",
"58848884753213840485448397759495923723",
"116583653654920597412434854009147603238",
"1428151623031102437515776038637161871",
"84847328777333707733802179476597622322",
"10594956851738352006688634450098480540",
"277794321212712877056334113497103181534",
"269243800665829050404757074461860162204",
"26762979477277382980830317874955293536",
"311846408260232207350039183837932564226",
"253527872387787342346279399434958010791",
"41453657004905179703412491308095597393",
"336799810514586160437667406390580163712",
"270459555378018104423395858436204401940",
"324559284555528506755555471605310864786",
"181808009718212662714901941166398539600",
"246936129722968358891680820784593662142",
"262598448752606199306890400315070245421",
"59331282107435644421890046864510800960",
"25876194962203842577837099868555082170",
"12403795231477865426042543180022310046"
]
},
"id": "CVE-2024-57883-29289fb2",
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02333ac1c35370517a19a4a131332a9690c6a5c7",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"99893198213390893123259210717980805239",
"113888618367253573116742241215514756853",
"130537043325225109163228387271727299690",
"185528287040773307224662316262184803716"
]
},
"id": "CVE-2024-57883-2d92711a",
"signature_type": "Line",
"target": {
"file": "include/linux/mm_types.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8410996eb6fea116fe1483ed977aacf580eee7b4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "17598763055163009899400030228085062914",
"length": 494.0
},
"id": "CVE-2024-57883-2f6be411",
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56b274473d6e7e7375f2d0a2b4aca11d67c6b52f",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52232912709650045397853783435819886549",
"123858457902006965935407888641844021343",
"63572277096252519616758852251449094009",
"163513243853257162925906220926610667879",
"113888618367253573116742241215514756853",
"234970968954747603698716456029417191718",
"109109676721269248060219807572705305148",
"37745504813731782619235465594061101161",
"152098064935390275929718322195679383543",
"216583128467915004541404730811177181358"
]
},
"id": "CVE-2024-57883-30ef3f88",
"signature_type": "Line",
"target": {
"file": "include/linux/mm_types.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "17598763055163009899400030228085062914",
"length": 494.0
},
"id": "CVE-2024-57883-3791a52e",
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8410996eb6fea116fe1483ed977aacf580eee7b4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274656540787742369773148142458781878772",
"122684493009316058816140542009108408072",
"327282355790333758278258982439403745058",
"199656671783941939235682972782469307028",
"58848884753213840485448397759495923723",
"116583653654920597412434854009147603238",
"297237675484144540324874054886061130758",
"31612830900518239311330107522858991030",
"325794401557846313694651033169038060527",
"19980057831535442243597031990729846505",
"34807421929298661370426289148645275268",
"253053987179842189567009227602658004954",
"121012560098491200044891351560347450536",
"63571149337518835677258256701088771015",
"280080725298130184912316184915685453949",
"298000168160605398629214728679006031592",
"200019789807041431012550665545869912927",
"6795263051558649630632731704622774629",
"246936129722968358891680820784593662142",
"262598448752606199306890400315070245421",
"59331282107435644421890046864510800960",
"54979326509637091869192925605636031547",
"95090763953696784821972549276560438116"
]
},
"id": "CVE-2024-57883-45869b41",
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02333ac1c35370517a19a4a131332a9690c6a5c7",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274656540787742369773148142458781878772",
"122684493009316058816140542009108408072",
"327282355790333758278258982439403745058",
"199656671783941939235682972782469307028",
"58848884753213840485448397759495923723",
"116583653654920597412434854009147603238",
"297237675484144540324874054886061130758",
"31612830900518239311330107522858991030",
"10594956851738352006688634450098480540",
"277794321212712877056334113497103181534",
"269243800665829050404757074461860162204",
"26762979477277382980830317874955293536",
"311846408260232207350039183837932564226",
"253527872387787342346279399434958010791",
"41453657004905179703412491308095597393",
"336799810514586160437667406390580163712",
"270459555378018104423395858436204401940",
"324559284555528506755555471605310864786",
"181808009718212662714901941166398539600",
"246936129722968358891680820784593662142",
"262598448752606199306890400315070245421",
"59331282107435644421890046864510800960",
"25876194962203842577837099868555082170",
"12403795231477865426042543180022310046"
]
},
"id": "CVE-2024-57883-4e591baa",
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59d9094df3d79443937add8700b2ef1a866b1081",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52232912709650045397853783435819886549",
"123858457902006965935407888641844021343",
"63572277096252519616758852251449094009",
"276107308515881798255681671966928263442",
"101737720647050889506124660692884311529",
"234970968954747603698716456029417191718",
"109109676721269248060219807572705305148",
"37745504813731782619235465594061101161",
"152098064935390275929718322195679383543",
"216583128467915004541404730811177181358"
]
},
"id": "CVE-2024-57883-4e80094b",
"signature_type": "Line",
"target": {
"file": "include/linux/mm_types.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8410996eb6fea116fe1483ed977aacf580eee7b4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "31716066050147789124089596546368277088",
"length": 946.0
},
"id": "CVE-2024-57883-63d6ea1e",
"signature_type": "Function",
"target": {
"function": "huge_pmd_share",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56b274473d6e7e7375f2d0a2b4aca11d67c6b52f",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253291055723695488000156452098876199914",
"122684493009316058816140542009108408072",
"327282355790333758278258982439403745058",
"199656671783941939235682972782469307028",
"58848884753213840485448397759495923723",
"116583653654920597412434854009147603238",
"1428151623031102437515776038637161871",
"84847328777333707733802179476597622322",
"10594956851738352006688634450098480540",
"277794321212712877056334113497103181534",
"269243800665829050404757074461860162204",
"26762979477277382980830317874955293536",
"311846408260232207350039183837932564226",
"253527872387787342346279399434958010791",
"41453657004905179703412491308095597393",
"336799810514586160437667406390580163712",
"270459555378018104423395858436204401940",
"324559284555528506755555471605310864786",
"181808009718212662714901941166398539600",
"246936129722968358891680820784593662142",
"262598448752606199306890400315070245421",
"59331282107435644421890046864510800960",
"25876194962203842577837099868555082170",
"12403795231477865426042543180022310046"
]
},
"id": "CVE-2024-57883-68e0342a",
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e31443a0d18ae43b9d29e02bf0563f07772193d",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241984197564115567285268710434833730930",
"42241276663333915754760607243291358075",
"100394944923470798433535377080939513543",
"272288672805085525595295693591529254571"
]
},
"id": "CVE-2024-57883-6d37ff8b",
"signature_type": "Line",
"target": {
"file": "include/linux/mm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e31443a0d18ae43b9d29e02bf0563f07772193d",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253291055723695488000156452098876199914",
"122684493009316058816140542009108408072",
"327282355790333758278258982439403745058",
"199656671783941939235682972782469307028",
"58848884753213840485448397759495923723",
"116583653654920597412434854009147603238",
"1428151623031102437515776038637161871",
"84847328777333707733802179476597622322",
"10594956851738352006688634450098480540",
"277794321212712877056334113497103181534",
"269243800665829050404757074461860162204",
"26762979477277382980830317874955293536",
"311846408260232207350039183837932564226",
"253527872387787342346279399434958010791",
"41453657004905179703412491308095597393",
"336799810514586160437667406390580163712",
"270459555378018104423395858436204401940",
"324559284555528506755555471605310864786",
"181808009718212662714901941166398539600",
"246936129722968358891680820784593662142",
"262598448752606199306890400315070245421",
"59331282107435644421890046864510800960",
"25876194962203842577837099868555082170",
"12403795231477865426042543180022310046"
]
},
"id": "CVE-2024-57883-6e3fec41",
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59d9094df3d79443937add8700b2ef1a866b1081",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "270429774181620069963190038942413578694",
"length": 474.0
},
"id": "CVE-2024-57883-9536c7f9",
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56b274473d6e7e7375f2d0a2b4aca11d67c6b52f",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241984197564115567285268710434833730930",
"42241276663333915754760607243291358075",
"100394944923470798433535377080939513543",
"272288672805085525595295693591529254571"
]
},
"id": "CVE-2024-57883-a39c41b4",
"signature_type": "Line",
"target": {
"file": "include/linux/mm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e31443a0d18ae43b9d29e02bf0563f07772193d",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "270429774181620069963190038942413578694",
"length": 474.0
},
"id": "CVE-2024-57883-aae66869",
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56b274473d6e7e7375f2d0a2b4aca11d67c6b52f",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "270429774181620069963190038942413578694",
"length": 474.0
},
"id": "CVE-2024-57883-b0472354",
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "278436298166785222384301945872424750033",
"length": 1051.0
},
"id": "CVE-2024-57883-b5f89c1c",
"signature_type": "Function",
"target": {
"function": "huge_pmd_share",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8410996eb6fea116fe1483ed977aacf580eee7b4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"99893198213390893123259210717980805239",
"113888618367253573116742241215514756853",
"130537043325225109163228387271727299690",
"185528287040773307224662316262184803716"
]
},
"id": "CVE-2024-57883-c619ad6f",
"signature_type": "Line",
"target": {
"file": "include/linux/mm_types.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8410996eb6fea116fe1483ed977aacf580eee7b4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234843866071468673131104843032855415385",
"80535375184292007137505865509078955222",
"285234235637386433054073770427926348727",
"56489930324449337619757066314041707148"
]
},
"id": "CVE-2024-57883-d55ce1bd",
"signature_type": "Line",
"target": {
"file": "include/linux/mm.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02333ac1c35370517a19a4a131332a9690c6a5c7",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "15655195964029974200976982266121866190",
"length": 965.0
},
"id": "CVE-2024-57883-d6e29680",
"signature_type": "Function",
"target": {
"function": "huge_pmd_share",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"99893198213390893123259210717980805239",
"113888618367253573116742241215514756853",
"130537043325225109163228387271727299690",
"185528287040773307224662316262184803716"
]
},
"id": "CVE-2024-57883-db10e5d1",
"signature_type": "Line",
"target": {
"file": "include/linux/mm_types.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02333ac1c35370517a19a4a131332a9690c6a5c7",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "270429774181620069963190038942413578694",
"length": 474.0
},
"id": "CVE-2024-57883-e00496f0",
"signature_type": "Function",
"target": {
"function": "huge_pmd_unshare",
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"274656540787742369773148142458781878772",
"122684493009316058816140542009108408072",
"327282355790333758278258982439403745058",
"199656671783941939235682972782469307028",
"58848884753213840485448397759495923723",
"116583653654920597412434854009147603238",
"297237675484144540324874054886061130758",
"31612830900518239311330107522858991030",
"325794401557846313694651033169038060527",
"19980057831535442243597031990729846505",
"34807421929298661370426289148645275268",
"253053987179842189567009227602658004954",
"121012560098491200044891351560347450536",
"63571149337518835677258256701088771015",
"280080725298130184912316184915685453949",
"298000168160605398629214728679006031592",
"200019789807041431012550665545869912927",
"6795263051558649630632731704622774629",
"246936129722968358891680820784593662142",
"262598448752606199306890400315070245421",
"59331282107435644421890046864510800960",
"54979326509637091869192925605636031547",
"95090763953696784821972549276560438116"
]
},
"id": "CVE-2024-57883-f9e1842f",
"signature_type": "Line",
"target": {
"file": "mm/hugetlb.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02333ac1c35370517a19a4a131332a9690c6a5c7",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"234843866071468673131104843032855415385",
"80535375184292007137505865509078955222",
"285234235637386433054073770427926348727",
"56489930324449337619757066314041707148"
]
},
"id": "CVE-2024-57883-ffb8b52d",
"signature_type": "Line",
"target": {
"file": "include/linux/mm.h"
}
}
]