CVE: CVE-2024-40949
Published: 2024-07-12
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: shmem: fix getting incorrect lruvec when replacing a shmem folio

When testing shmem swapin, I encountered the warning below on my machine. 
The reason is that replacing an old shmem folio with a new one causes
mem_cgroup_migrate() to clear the old folio's memcg data.  As a result,
the old folio cannot get the correct memcg's lruvec needed to remove
itself from the LRU list when it is being freed.  This could lead to
possible serious problems, such as LRU list crashes due to holding the
wrong LRU lock, and incorrect LRU statistics.

To fix this issue, we can fallback to use the mem_cgroup_replace_folio()
to replace the old shmem folio.

[ 5241.100311] page: refcount:0 mapcount:0 mapping:[PII_REDACTED] index:0x0 pfn:0x5d9960
[ 5241.100317] head: order:4 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 5241.100319] flags: 0x17fffe[PII_REDACTED](uptodate|lru|head|swapbacked|node=0|zone=2|lastcpupid=0x3ffff)
[ 5241.100323] raw: 17fffe[PII_REDACTED] fffffdffd6687948 fffffdffd69ae008 [PII_REDACTED]
[ 5241.100325] raw: [PII_REDACTED] [PII_REDACTED] 00000000ffffffff [PII_REDACTED]
[ 5241.100326] head: 17fffe[PII_REDACTED] fffffdffd6687948 fffffdffd69ae008 [PII_REDACTED]
[ 5241.100327] head: [PII_REDACTED] [PII_REDACTED] 00000000ffffffff [PII_REDACTED]
[ 5241.100328] head: 17fffe[PII_REDACTED] fffffdffd6665801 ffffffffffffffff [PII_REDACTED]
[ 5241.100329] head: 0000000a00000010 [PII_REDACTED] 00000000ffffffff [PII_REDACTED]
[ 5241.100330] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled())
[ 5241.100338] ------------[ cut here ]------------
[ 5241.100339] WARNING: CPU: 19 PID: 78402 at include/linux/memcontrol.h:775 folio_lruvec_lock_irqsave+0x140/0x150
[...]
[ 5241.100374] pc : folio_lruvec_lock_irqsave+0x140/0x150
[ 5241.100375] lr : folio_lruvec_lock_irqsave+0x138/0x150
[ 5241.100376] sp : ffff80008b38b930
[...]
[ 5241.100398] Call trace:
[ 5241.100399]  folio_lruvec_lock_irqsave+0x140/0x150
[ 5241.100401]  __page_cache_release+0x90/0x300
[ 5241.100404]  __folio_put+0x50/0x108
[ 5241.100406]  shmem_replace_folio+0x1b4/0x240
[ 5241.100409]  shmem_swapin_folio+0x314/0x528
[ 5241.100411]  shmem_get_folio_gfp+0x3b4/0x930
[ 5241.100412]  shmem_fault+0x74/0x160
[ 5241.100414]  __do_fault+0x40/0x218
[ 5241.100417]  do_shared_fault+0x34/0x1b0
[ 5241.100419]  do_fault+0x40/0x168
[ 5241.100420]  handle_pte_fault+0x80/0x228
[ 5241.100422]  __handle_mm_fault+0x1c4/0x440
[ 5241.100424]  handle_mm_fault+0x60/0x1f0
[ 5241.100426]  do_page_fault+0x120/0x488
[ 5241.100429]  do_translation_fault+0x4c/0x68
[ 5241.100431]  do_mem_abort+0x48/0xa0
[ 5241.100434]  el0_da+0x38/0xc0
[ 5241.100436]  el0t_64_sync_handler+0x68/0xc0
[ 5241.100437]  el0t_64_sync+0x14c/0x150
[ 5241.100439] ---[ end trace [PII_REDACTED] ]---

[baolin.wang@linux.alibaba.com: remove less helpful comments, per Matthew]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/8c6c3719ebb7913f8a665d11816d2e38b0eadbab; https://git.kernel.org/stable/c/9094b4a1c76cfe84b906cc152bab34d4ba26fa5c; https://git.kernel.org/stable/c/8c6c3719ebb7913f8a665d11816d2e38b0eadbab