CVE-2021-47090
Assigner: Linux
Published: 2024-03-04T18:10:28.887Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()

Hulk Robot reported a panic in put_page_testzero() when testing
madvise() with MADV_SOFT_OFFLINE.  The BUG() is triggered when retrying
get_any_page().  This is because we keep MF_COUNT_INCREASED flag in
second try but the refcnt is not increased.

    page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
    ------------[ cut here ]------------
    kernel BUG at include/linux/mm.h:737!
    invalid opcode: 0000 [#1] PREEMPT SMP
    CPU: 5 PID: 2135 Comm: sshd Tainted: G    B             5.16.0-rc6-dirty #373
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
    RIP: release_pages+0x53f/0x840
    Call Trace:
      free_pages_and_swap_cache+0x64/0x80
      tlb_flush_mmu+0x6f/0x220
      unmap_page_range+0xe6c/0x12c0
      unmap_single_vma+0x90/0x170
      unmap_vmas+0xc4/0x180
      exit_mmap+0xde/0x3a0
      mmput+0xa3/0x250
      do_exit+0x564/0x1470
      do_group_exit+0x3b/0x100
      __do_sys_exit_group+0x13/0x20
      __x64_sys_exit_group+0x16/0x20
      do_syscall_64+0x34/0x80
      entry_SYSCALL_64_after_hwframe+0x44/0xae
    Modules linked in:
    ---[ end trace e99579b570fe0649 ]---
    RIP: 0010:release_pages+0x53f/0x840
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: b94e02822deb
lessThan: 1f2070767401
status: affected
versionType: git
version: b94e02822deb
lessThan: c691e7575eff
status: affected
versionType: git
version: b94e02822deb
lessThan: 2a57d83c78f8
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.10
status: affected
version: 0
lessThan: 5.10
status: unaffected
versionType: custom
version: 5.10.89
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.12
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 5.16
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
x_generator: engine: bippy-4986f5686161