In the Linux kernel, the following vulnerability has been resolved:
mm/sparsemem: fix race in accessing memory_section->usage
The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains the device memory PFN's as well, the compaction triggered will try on the device memory PFN's too though they end up in NOP(because pfn_to_online_page() returns NULL for ZONE_DEVICE memory sections). When from other core, the section mappings are being removed for the ZONE_DEVICE region, that the PFN in question belongs to, on which compaction is currently being operated is resulting into the kernel crash with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1].
compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid(): valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate(): [Free the array ms->usage and set ms->usage = NULL] pfn_section_valid() [Access ms->usage which is NULL]
NOTE: From the above it can be said that the race is reduced to between the pfn_valid()/pfn_section_valid() and the section deactivate with SPASEMEM_VMEMAP enabled.
The commit b943f045a9af("mm/sparse: fix kernel crash with pfn_section_valid check") tried to address the same problem by clearing the SECTION_HAS_MEM_MAP with the expectation of valid_section() returns false thus ms->usage is not accessed.
Fix this issue by the below steps:
a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage.
b) RCU protected read side critical section will either return NULL when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage.
c) Free the ->usage with kfree_rcu() and set ms->usage = NULL. No attempt will be made to access ->usage after this as the SECTION_HAS_MEM_MAP is cleared thus valid_section() return false.
Thanks to David/Pavan for their inputs on this patch.
[1] https://lore.kernel.org/linux-mm/[email protected]/
On Snapdragon SoC, with the mentioned memory configuration of PFN's as [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of issues daily while testing on a device farm.
For this particular issue below is the log. Though the below log is not directly pointing to the pfn_section_valid(){ ms->usage;}, when we loaded this dump on T32 lauterbach tool, it is pointing.
[ 540.578056] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 540.578068] Mem abort info: [ 540.578070] ESR = 0x0000000096000005 [ 540.578073] EC = 0x25: DABT (current EL), IL = 32 bits [ 540.578077] SET = 0, FnV = 0 [ 540.578080] EA = 0, S1PTW = 0 [ 540.578082] FSC = 0x05: level 1 translation fault [ 540.578085] Data abort info: [ 540.578086] ISV = 0, ISS = 0x00000005 [ 540.578088] CM = 0, WnR = 0 [ 540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--) [ 540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c [ 540.579454] lr : compact_zone+0x994/0x1058 [ 540.579460] sp : ffffffc03579b510 [ 540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c [ 540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640 [ 540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000 [ 540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140 [ 540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff [ 540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001 [ 540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440 [ 540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4 [ 540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-64k-modules-coreUpgrade kernelUpgrade python3-perfUpgrade kernel-modulesUpgrade rtlaUpgrade perfUpgrade kernel-tools-libsUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-rt-kvmUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-64k-modules-extraUpgrade kernel-64k-develUpgrade kernel-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modulesUpgrade bpftoolUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-64kUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-uki-virtUpgrade kernel-tools-libs-develUpgrade kernel-docUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade rvUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-coreUpgrade kernel-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-rt-modules-extraUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rtUpgrade kernel-headersUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extra | May 31, 2024 | Mar 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.15.149-99.161Upgrade kernel-livepatch-5.10.210-201.852Upgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade python-perfUpgrade perf | Jun 11, 2024 | Mar 11, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-perfUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-modules-extra-commonUpgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-livepatch-6.1.77-99.164 | Feb 17, 2025 | Feb 29, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 11, 2024 |
| Oracle_linux | — | Upgrade kernel | May 14, 2024 | Feb 29, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | May 23, 2024 | Mar 11, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-develUpgrade bpftool-debuginfoUpgrade kernel-cross-headersUpgrade python3-perfUpgrade kernel-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-rt-kvmUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-rt-debugUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-debug-coreUpgrade kernel-develUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modules | Jun 17, 2024 | Mar 11, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-intelUpgrade linux-image-oem-20.04bUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-oem-20.04Upgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-aws-lts-22.04Upgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-oem-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-virtualUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-22.04dUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-awsUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1063-azureUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-oracleUpgrade linux-image-nvidia-6.5Upgrade linux-image-5.15.0-1061-awsUpgrade linux-image-oem-20.04cUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-starfiveUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcpUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-laptop-23.10Upgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-oem-22.04bUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-106-generic-64k | May 17, 2024 | Mar 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub