CVE-2022-50630

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: fix UAF in hugetlbhandleuserfault

The vmalock and hugetlbfaultmutex are dropped before handling userfault and reacquire them again after handleuserfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race,

hugetlbfault hugetlbnopage /*unlock vmalock */ hugetlbhandleuserfault handleuserfault /* unlock mm->mmaplock*/ vmmmappgoff dommap mmapregion munmapvmarange /* clean old vma / / lock vmalock again <--- UAF / / unlock vmalock */

Since the vmalock will unlock immediately after hugetlbhandleuserfault(), let's drop the unneeded lock and unlock in hugetlbhandle_userfault() to fix the issue.

[1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/