CVE: CVE-2023-53621
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

memcontrol: ensure memcg acquired by id is properly set up

In the eviction recency check, we attempt to retrieve the memcg to which
the folio belonged when it was evicted, by the memcg id stored in the
shadow entry.  However, there is a chance that the retrieved memcg is not
the original memcg that has been killed, but a new one which happens to
have the same id.

This is a somewhat unfortunate, but acceptable and rare inaccuracy in the
heuristics.  However, if we retrieve this new memcg between its allocation
and when it is properly attached to the memcg hierarchy, we could run into
the following NULL pointer exception during the memcg hierarchy traversal
done in mem_cgroup_get_nr_swap_pages():

[[PII_REDACTED]56] BUG: kernel NULL pointer dereference, address:[PII_REDACTED]0000c0
[[PII_REDACTED]68] #PF: supervisor read access in kernel mode
[[PII_REDACTED]24] #PF: error_code(0x0000) - not-present page
[[PII_REDACTED]82] PGD 401f77067 P4D 401f77067 PUD 401f76067 PMD 0
[[PII_REDACTED]85] Oops: 0000 [#1] SMP
[[PII_REDACTED]70] RIP: 0010:mem_cgroup_get_nr_swap_pages+0x3d/0xb0
[[PII_REDACTED]77] Code: 29 19 4a 02 48 39 f9 74 63 48 8b 97 c0 00 00 00 48 8b b7 58 02 00 00 48 2b b7 c0 01 00 00 48 39 f0 48 0f 4d c6 48 39 d1 74 42 <48> 8b b2 c0 00 00 00 48 8b ba 58 02 00 00 48 2b ba c0 01 00 00 48
[[PII_REDACTED]25] RSP: 0018:ffffc9002ecdfbc8 EFLAGS: 00010286
[[PII_REDACTED]55] RAX:[PII_REDACTED]3a3b1c RBX: 000007ffffffffff RCX: ffff[PII_REDACTED]00
[[PII_REDACTED]02] RDX: [PII_REDACTED] RSI: 0007ffffffffffff RDI: ffff888bbc2d1000
[[PII_REDACTED]48] RBP: [PII_REDACTED] R08:[PII_REDACTED]00000b R09: ffff888ad9cedba0
[[PII_REDACTED]94] R10: ffffea0039c07900 R11: [PII_REDACTED] R12: ffff888b23a7b000
[[PII_REDACTED]40] R13: [PII_REDACTED] R14: ffff888bbc2d1000 R15: 000007ffffc71354
[[PII_REDACTED]91] FS:  00007f6234c68640(0000) GS:ffff88903f9c0000(0000) knlGS:[PII_REDACTED]
[[PII_REDACTED]56] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[[PII_REDACTED]23] CR2:[PII_REDACTED]0000c0 CR3: 0000000a83eb8004 CR4:[PII_REDACTED]7706e0
[[PII_REDACTED]73] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
[[PII_REDACTED]24] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
[[PII_REDACTED]76] PKRU: 55555554
[[PII_REDACTED]57] Call Trace:
[[PII_REDACTED]16]  <TASK>
[[PII_REDACTED]02]  ? __die+0x78/0xc0
[[PII_REDACTED]93]  ? page_fault_oops+0x286/0x380
[[PII_REDACTED]75]  ? exc_page_fault+0x5d/0x110
[[PII_REDACTED]09]  ? asm_exc_page_fault+0x22/0x30
[[PII_REDACTED]63]  ? mem_cgroup_get_nr_swap_pages+0x3d/0xb0
[[PII_REDACTED]60]  workingset_test_recent+0xda/0x1b0
[[PII_REDACTED]33]  workingset_refault+0xca/0x1e0
[[PII_REDACTED]08]  filemap_add_folio+0x4d/0x70
[[PII_REDACTED]38]  page_cache_ra_unbounded+0xed/0x190
[[PII_REDACTED]19]  page_cache_sync_ra+0xd6/0x1e0
[[PII_REDACTED]38]  filemap_read+0x68d/0xdf0
[[PII_REDACTED]95]  ? mlx5e_napi_poll+0x123/0x940
[[PII_REDACTED]81]  ? __napi_schedule+0x55/0x90
[[PII_REDACTED]95]  __x64_sys_pread64+0x1d6/0x2c0
[[PII_REDACTED]01]  do_syscall_64+0x3d/0x80
[[PII_REDACTED]58]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
[[PII_REDACTED]73] RIP: 0033:0x7f62c29153b5
[[PII_REDACTED]38] Code: e8 48 89 75 f0 89 7d f8 48 89 4d e0 e8 b4 e6 f7 ff 41 89 c0 4c 8b 55 e0 48 8b 55 e8 48 8b 75 f0 8b 7d f8 b8 11 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 45 f8 e8 e7 e6 f7 ff 48 8b
[[PII_REDACTED]05] RSP: 002b:00007f6234c5ffd0 EFLAGS: 00000293 ORIG_RAX: [PII_REDACTED]
[[PII_REDACTED]74] RAX: ffffffffffffffda RBX: 00007f628c4e70c0 RCX: 00007f62c29153b5
[[PII_REDACTED]75] RDX:[PII_REDACTED]03c041 RSI: 00007f61d2986000 RDI: [PII_REDACTED]
[[PII_REDACTED]78] RBP: 00007f6234c5fff0 R08: [PII_REDACTED] R09:[PII_REDACTED]d5230c
[[PII_REDACTED]52] R10:[PII_REDACTED]27d450 R11: [PII_REDACTED] R12:[PII_REDACTED]03c041
[[PII_REDACTED]44] R13: 00007f61d2986000 R14: 00007f629e11b060 R15:[PII_REDACTED]27d450
[[PII_REDACTED]61]  </TASK>

This patch fixes the issue by moving the memcg's id publication from the
alloc stage to 
---truncated---
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://git.kernel.org/stable/c/6f0df8e16eb543167f2929cb756e695709a3551d; https://git.kernel.org/stable/c/b9d30c38ee859d833a51131b5b4b864c7a6219d0