Upstream information
Description
In the Linux kernel, the following vulnerability has been resolved: fs/proc: task_mmu.c: don't read mapcount for migration entry The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline] RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744 Call Trace: page_mapcount include/linux/mm.h:837 [inline] smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466 smaps_pte_entry fs/proc/task_mmu.c:538 [inline] smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601 walk_pmd_range mm/pagewalk.c:128 [inline] walk_pud_range mm/pagewalk.c:205 [inline] walk_p4d_range mm/pagewalk.c:240 [inline] walk_pgd_range mm/pagewalk.c:277 [inline] __walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379 walk_page_vma+0x277/0x350 mm/pagewalk.c:530 smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768 smap_gather_stats fs/proc/task_mmu.c:741 [inline] show_smap+0xc6/0x440 fs/proc/task_mmu.c:822 seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272 seq_read+0x3e0/0x5b0 fs/seq_file.c:162 vfs_read+0x1b5/0x600 fs/read_write.c:479 ksys_read+0x12d/0x250 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The reproducer was trying to read /proc/$PID/smaps when calling MADV_FREE at the mean time. MADV_FREE may split THPs if it is called for partial THP. It may trigger the below race: CPU A CPU B ----- ----- smaps walk: MADV_FREE: page_mapcount() PageCompound() split_huge_page() page = compound_head(page) PageDoubleMap(page) When calling PageDoubleMap() this page is not a tail page of THP anymore so the BUG is triggered. This could be fixed by elevated refcount of the page before calling mapcount, but that would prevent it from counting migration entries, and it seems overkilling because the race just could happen when PMD is split so all PTE entries of tail pages are actually migration entries, and smaps_account() does treat migration entries as mapcount == 1 as Kirill pointed out. Add a new parameter for smaps_account() to tell this entry is migration entry then skip calling page_mapcount(). Don't skip getting mapcount for device private entries since they do track references with mapcount. Pagemap also has the similar issue although it was not reported. Fixed it as well. [shy828301@gmail.com: v4] Link: https://lkml.kernel.org/r/20220203182641.824731-1-shy828301@gmail.com [nathan@kernel.org: avoid unused variable warning in pagemap_pmd_range()] Link: https://lkml.kernel.org/r/20220207171049.1102239-1-nathan@kernel.orgSUSE information
Overall state of this security issue: Pending
This issue is currently rated as having moderate severity.
SUSE Bugzilla entry: 1227942 [NEW] No SUSE Security Announcements cross referenced.Status of this issue by product and package
Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.
| Product(s) | Source package | State |
|---|---|---|
| Products under general support and receiving all security fixes. | ||
| SUSE Enterprise Storage 7.1 | kernel-default | Already fixed |
| SUSE Enterprise Storage 7.1 | kernel-source | Already fixed |
| SUSE Linux Enterprise Desktop 15 SP5 | kernel-default | Already fixed |
| SUSE Linux Enterprise Desktop 15 SP5 | kernel-source | Already fixed |
| SUSE Linux Enterprise Desktop 15 SP6 | kernel-default | Already fixed |
| SUSE Linux Enterprise Desktop 15 SP6 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 12 SP5 | kernel-default | Affected |
| SUSE Linux Enterprise High Performance Computing 12 SP5 | kernel-source | Affected |
| SUSE Linux Enterprise High Performance Computing 12 SP5 | kernel-source-azure | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | kernel-default | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5 | kernel-source-azure | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | kernel-default | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | kernel-source-azure | Already fixed |
| SUSE Linux Enterprise Micro 5.1 | kernel-default | Already fixed |
| SUSE Linux Enterprise Micro 5.1 | kernel-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.1 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.2 | kernel-default | Already fixed |
| SUSE Linux Enterprise Micro 5.2 | kernel-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.2 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.3 | kernel-default | Already fixed |
| SUSE Linux Enterprise Micro 5.3 | kernel-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.3 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.4 | kernel-default | Already fixed |
| SUSE Linux Enterprise Micro 5.4 | kernel-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.4 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Micro 5.5 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | kernel-default | Already fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | Already fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | kernel-default | Already fixed |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | kernel-default | Already fixed |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | kernel-source-azure | Already fixed |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | Already fixed |
| SUSE Linux Enterprise Real Time 12 SP5 | kernel-source-rt | Affected |
| SUSE Linux Enterprise Real Time 15 SP5 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Real Time 15 SP6 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Server 12 SP5 | kernel-default | Affected |
| SUSE Linux Enterprise Server 12 SP5 | kernel-source | Affected |
| SUSE Linux Enterprise Server 12 SP5 | kernel-source-azure | Affected |
| SUSE Linux Enterprise Server 15 SP5 | kernel-default | Already fixed |
| SUSE Linux Enterprise Server 15 SP5 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP5 | kernel-source-azure | Already fixed |
| SUSE Linux Enterprise Server 15 SP6 | kernel-default | Already fixed |
| SUSE Linux Enterprise Server 15 SP6 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP6 | kernel-source-azure | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | kernel-default | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | kernel-source | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | kernel-source-azure | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source-azure | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | kernel-default | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | kernel-source-azure | Already fixed |
| SUSE Manager Proxy 4.3 | kernel-default | Already fixed |
| SUSE Manager Proxy 4.3 | kernel-source | Already fixed |
| SUSE Manager Retail Branch Server 4.3 | kernel-default | Already fixed |
| SUSE Manager Retail Branch Server 4.3 | kernel-source | Already fixed |
| SUSE Manager Server 4.3 | kernel-default | Already fixed |
| SUSE Manager Server 4.3 | kernel-source | Already fixed |
| SUSE Real Time Module 15 SP5 | kernel-source-rt | Already fixed |
| SUSE Real Time Module 15 SP6 | kernel-source-rt | Already fixed |
| openSUSE Leap 15.5 | kernel-default | Already fixed |
| openSUSE Leap 15.5 | kernel-source | Already fixed |
| openSUSE Leap 15.5 | kernel-source-azure | Already fixed |
| openSUSE Leap 15.5 | kernel-source-rt | Already fixed |
| openSUSE Leap 15.6 | kernel-default | Already fixed |
| openSUSE Leap 15.6 | kernel-source | Already fixed |
| openSUSE Leap 15.6 | kernel-source-azure | Already fixed |
| openSUSE Leap 15.6 | kernel-source-rt | Already fixed |
| Products under Long Term Service Pack support and receiving important and critical security fixes. | ||
| SUSE Linux Enterprise Desktop 15 SP4 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP2 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | kernel-default | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP3 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-default | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-default | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | kernel-source | Already fixed |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | kernel-default | Not affected |
| SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE | kernel-source | Not affected |
| SUSE Linux Enterprise Server 15 SP2 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP2-LTSS | kernel-default | Already fixed |
| SUSE Linux Enterprise Server 15 SP2-LTSS | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP3 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP3-LTSS | kernel-default | Already fixed |
| SUSE Linux Enterprise Server 15 SP3-LTSS | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP4 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP4-LTSS | kernel-default | Already fixed |
| SUSE Linux Enterprise Server 15 SP4-LTSS | kernel-source | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | kernel-default | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | kernel-default | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | kernel-source | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default | Already fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | kernel-source | Already fixed |
| Products past their end of life and not receiving proactive updates anymore. | ||
| HPE Helion OpenStack 8 | kernel-source | Not affected |
| SUSE CaaS Platform 4.0 | kernel-source | Affected |
| SUSE Enterprise Storage 6 | kernel-source | Affected |
| SUSE Enterprise Storage 7 | kernel-source | Already fixed |
| SUSE Linux Enterprise Desktop 11 SP4 | kernel-source | Not affected |
| SUSE Linux Enterprise Desktop 12 SP3 | kernel-source | Not affected |
| SUSE Linux Enterprise Desktop 12 SP4 | kernel-source | Affected |
| SUSE Linux Enterprise Desktop 15 | kernel-source | Affected |
| SUSE Linux Enterprise Desktop 15 SP1 | kernel-source | Affected |
| SUSE Linux Enterprise Desktop 15 SP2 | kernel-source | Already fixed |
| SUSE Linux Enterprise Desktop 15 SP3 | kernel-source | Already fixed |
| SUSE Linux Enterprise High Performance Computing 15 | kernel-source | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP1 | kernel-source | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | kernel-source | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | kernel-source | Affected |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | kernel-source | Affected |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | kernel-source | Affected |
| SUSE Linux Enterprise Micro 5.0 | kernel-default | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 | kernel-source | Affected |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | kernel-source | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 | kernel-source | Affected |
| SUSE Linux Enterprise Module for Development Tools 15 SP1 | kernel-source | Affected |
| SUSE Linux Enterprise Real Time 15 SP2 | kernel-source | Already fixed |
| SUSE Linux Enterprise Real Time 15 SP3 | kernel-source | Already fixed |
| SUSE Linux Enterprise Real Time 15 SP3 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Real Time 15 SP4 | kernel-source | Already fixed |
| SUSE Linux Enterprise Real Time 15 SP4 | kernel-source-rt | Already fixed |
| SUSE Linux Enterprise Server 11 SP4 | kernel-source | Not affected |
| SUSE Linux Enterprise Server 11 SP4 LTSS | kernel-default | Not affected |
| SUSE Linux Enterprise Server 11 SP4 LTSS | kernel-source | Not affected |
| SUSE Linux Enterprise Server 11 SP4-LTSS | kernel-source | Not affected |
| SUSE Linux Enterprise Server 12 SP3 | kernel-source | Not affected |
| SUSE Linux Enterprise Server 12 SP3-BCL | kernel-source | Not affected |
| SUSE Linux Enterprise Server 12 SP3-ESPOS | kernel-source | Not affected |
| SUSE Linux Enterprise Server 12 SP3-LTSS | kernel-source | Not affected |
| SUSE Linux Enterprise Server 12 SP4 | kernel-source | Affected |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | kernel-source | Affected |
| SUSE Linux Enterprise Server 12 SP4-LTSS | kernel-default | Affected |
| SUSE Linux Enterprise Server 12 SP4-LTSS | kernel-source | Affected |
| SUSE Linux Enterprise Server 15 | kernel-source | Affected |
| SUSE Linux Enterprise Server 15 SP1 | kernel-source | Affected |
| SUSE Linux Enterprise Server 15 SP1-BCL | kernel-source | Affected |
| SUSE Linux Enterprise Server 15 SP1-LTSS | kernel-default | Affected |
| SUSE Linux Enterprise Server 15 SP1-LTSS | kernel-source | Affected |
| SUSE Linux Enterprise Server 15 SP2-BCL | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15 SP3-BCL | kernel-source | Already fixed |
| SUSE Linux Enterprise Server 15-LTSS | kernel-default | Affected |
| SUSE Linux Enterprise Server 15-LTSS | kernel-source | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | kernel-source | Not affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | kernel-default | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | kernel-source | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 | kernel-source | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | kernel-source | Affected |
| SUSE Manager Proxy 4.0 | kernel-source | Affected |
| SUSE Manager Proxy 4.1 | kernel-source | Already fixed |
| SUSE Manager Proxy 4.2 | kernel-source | Already fixed |
| SUSE Manager Retail Branch Server 4.0 | kernel-source | Affected |
| SUSE Manager Retail Branch Server 4.1 | kernel-source | Already fixed |
| SUSE Manager Retail Branch Server 4.2 | kernel-source | Already fixed |
| SUSE Manager Server 4.0 | kernel-source | Affected |
| SUSE Manager Server 4.1 | kernel-source | Already fixed |
| SUSE Manager Server 4.2 | kernel-source | Already fixed |
| SUSE OpenStack Cloud 8 | kernel-source | Not affected |
| SUSE OpenStack Cloud 9 | kernel-source | Affected |
| SUSE OpenStack Cloud Crowbar 8 | kernel-source | Not affected |
| SUSE OpenStack Cloud Crowbar 9 | kernel-source | Affected |
| SUSE Real Time Module 15 SP3 | kernel-source-rt | Already fixed |
| SUSE Real Time Module 15 SP4 | kernel-source-rt | Already fixed |
| openSUSE Leap 15.3 | kernel-source | Already fixed |
| openSUSE Leap 15.3 | kernel-source-rt | Already fixed |
| openSUSE Leap 15.4 | kernel-source | Already fixed |
| openSUSE Leap 15.4 | kernel-source-azure | Unsupported |
| openSUSE Leap 15.4 | kernel-source-rt | Already fixed |
| Products at an unknown state of their lifecycle. | ||
| SUSE CaaS Platform Toolchain 3 | kernel-source | Not affected |
SUSE Timeline for this CVE
CVE page created: Tue Jul 16 14:01:16 2024CVE page last modified: Wed Jul 17 11:43:27 2024