CVE: CVE-2024-39298
Published: 2024-06-25
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/memory-failure: fix handling of dissolved but not taken off from buddy pages

When I did memory failure tests recently, below panic occurs:

page: refcount:0 mapcount:0 mapping:[PII_REDACTED] index:0x0 pfn:0x8cee00
flags: 0x6fffe[PII_REDACTED](node=1|zone=2|lastcpupid=0x7fff)
raw: 06fffe[PII_REDACTED] dead[PII_REDACTED]00 dead[PII_REDACTED]22 [PII_REDACTED]
raw: [PII_REDACTED] [PII_REDACTED] 00000000ffffffff [PII_REDACTED]
page dumped because: VM_BUG_ON_PAGE(!PageBuddy(page))
------------[ cut here ]------------
kernel BUG at include/linux/page-flags.h:1009!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
RIP: 0010:__del_page_from_free_list+0x151/0x180
RSP: 0018:ffffa49c90437998 EFLAGS: 00000046
RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: ffff8dd8dfd1c9c8
RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff8dd8dfd1c9c0
RBP: ffffd901233b8000 R08: ffffffffab5511f8 R09:[PII_REDACTED]008c69
R10:[PII_REDACTED]003c15 R11: ffffffffab5511f8 R12: ffff8dd8fffc0c80
R13: [PII_REDACTED] R14: ffff8dd8fffc0c80 R15: [PII_REDACTED]
FS:  00007ff916304740(0000) GS:ffff8dd8dfd00000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: 000055eae50124c8 CR3:[PII_REDACTED]9e0000 CR4:[PII_REDACTED]0006f0
Call Trace:
 <TASK>
 __rmqueue_pcplist+0x23b/0x520
 get_page_from_freelist+0x26b/0xe40
 __alloc_pages_noprof+0x113/0x1120
 __folio_alloc_noprof+0x11/0xb0
 alloc_buddy_hugetlb_folio.isra.0+0x5a/0x130
 __alloc_fresh_hugetlb_folio+0xe7/0x140
 alloc_pool_huge_folio+0x68/0x100
 set_max_huge_pages+0x13d/0x340
 hugetlb_sysctl_handler_common+0xe8/0x110
 proc_sys_call_handler+0x194/0x280
 vfs_write+0x387/0x550
 ksys_write+0x64/0xe0
 do_syscall_64+0xc2/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff916114887
RSP: 002b:00007ffec8a2fd78 EFLAGS: 00000246 ORIG_RAX: [PII_REDACTED]
RAX: ffffffffffffffda RBX: 000055eae500e350 RCX: 00007ff916114887
RDX: [PII_REDACTED] RSI: 000055eae500e390 RDI: [PII_REDACTED]
RBP: 000055eae50104c0 R08: [PII_REDACTED] R09: 000055eae50104c0
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: [PII_REDACTED]
R13: [PII_REDACTED] R14: 00007ff916216b80 R15: 00007ff916216a00
 </TASK>
Modules linked in: mce_inject hwpoison_inject
---[ end trace [PII_REDACTED] ]---

And before the panic, there had an warning about bad page state:

BUG: Bad page state in process page-types  pfn:8cee00
page: refcount:0 mapcount:0 mapping:[PII_REDACTED] index:0x0 pfn:0x8cee00
flags: 0x6fffe[PII_REDACTED](node=1|zone=2|lastcpupid=0x7fff)
page_type: 0xffffff7f(buddy)
raw: 06fffe[PII_REDACTED] ffffd901241c0008 ffffd901240f8008 [PII_REDACTED]
raw: [PII_REDACTED] [PII_REDACTED] 00000000ffffff7f [PII_REDACTED]
page dumped because: nonzero mapcount
Modules linked in: mce_inject hwpoison_inject
CPU: 8 PID: 154211 Comm: page-types Not tainted 6.9.0-rc4-00499-g5544ec3178e2-dirty #22
Call Trace:
 <TASK>
 dump_stack_lvl+0x83/0xa0
 bad_page+0x63/0xf0
 free_unref_page+0x36e/0x5c0
 unpoison_memory+0x50b/0x630
 simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110
 debugfs_attr_write+0x42/0x60
 full_proxy_write+0x5b/0x80
 vfs_write+0xcd/0x550
 ksys_write+0x64/0xe0
 do_syscall_64+0xc2/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f189a514887
RSP: 002b:00007ffdcd899718 EFLAGS: 00000246 ORIG_RAX: [PII_REDACTED]
RAX: ffffffffffffffda RBX: [PII_REDACTED] RCX: 00007f189a514887
RDX: [PII_REDACTED] RSI: 00007ffdcd899730 RDI: [PII_REDACTED]
RBP: 00007ffdcd8997a0 R08: [PII_REDACTED] R09: 00007ffdcd8994b2
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: 00007ffdcda199a8
R13:[PII_REDACTED]404af1 R14:[PII_REDACTED]40ad78 R15: 00007f189a7a5040
 </TASK>

The root cause should be the below race:

 memory_failure
  try_memory_failure_hugetlb
   me_huge_page
    __page_handle_poison
     dissolve_free_hugetlb_folio
     drain_all_pages -- Buddy page can be isolated e.g. for compaction.
     take_page_off_buddy -- Failed as page is not in the 
---truncated---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00b0752c7f15dfdf129cacc6a27d61c54141182b; https://git.kernel.org/stable/c/41cd2de3c95020b7f86a3cb5fab42fbf454a63bd; https://git.kernel.org/stable/c/8cf360b9d6a840700e06864236a01a883b34bbad