Description
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: release page in error path to avoid BUG_ON Consider the following sequence of events: 1. Userspace issues a UFFD ioctl, which ends up calling into shmem_mfill_atomic_pte(). We successfully account the blocks, we shmem_alloc_page(), but then the copy_from_user() fails. We return -ENOENT. We don't release the page we allocated. 2. Our caller detects this error code, tries the copy_from_user() after dropping the mmap_lock, and retries, calling back into shmem_mfill_atomic_pte(). 3. Meanwhile, let's say another process filled up the tmpfs being used. 4. So shmem_mfill_atomic_pte() fails to account blocks this time, and immediately returns - without releasing the page. This triggers a BUG_ON in our caller, which asserts that the page should always be consumed, unless -ENOENT is returned. To fix this, detect if we have such a "dangling" page when accounting fails, and if so, release it before returning.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cb658a453b9327ce96ce5222c24d162b5b65b564 to < 319116227e52d49eee671f0aa278bac89b3c1b69affectedcb658a453b9327ce96ce5222c24d162b5b65b564 to < 07c9b834c97d0fa3402fb7f3f3b32df370a6ff1faffectedcb658a453b9327ce96ce5222c24d162b5b65b564 to < b3f1731c6d7fbc1ebe3ed8eff6d6bec56d76ff43affectedcb658a453b9327ce96ce5222c24d162b5b65b564 to < 140cfd9980124aecb6c03ef2e69c72d0548744deaffectedcb658a453b9327ce96ce5222c24d162b5b65b564 to < ad53127973034c63b5348715a1043d0e80ceb330affectedcb658a453b9327ce96ce5222c24d162b5b65b564 to < 2d59a0ed8b26b8f3638d8afc31f839e27759f1f6affectedcb658a453b9327ce96ce5222c24d162b5b65b564 to < 7ed9d238c7dbb1fdb63ad96a6184985151b0171caffected
Linux Linux
Default version status: affected
4.11affected0 to < 4.11unaffected4.14.233 to ≤ 4.14.*unaffected4.19.191 to ≤ 4.19.*unaffected5.4.120 to ≤ 5.4.*unaffected5.10.38 to ≤ 5.10.*unaffected5.11.22 to ≤ 5.11.*unaffected5.12.5 to ≤ 5.12.*unaffected5.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/319116227e52d49eee671f0aa278bac89b3c1b69 ↗
- https://git.kernel.org/stable/c/07c9b834c97d0fa3402fb7f3f3b32df370a6ff1f ↗
- https://git.kernel.org/stable/c/b3f1731c6d7fbc1ebe3ed8eff6d6bec56d76ff43 ↗
- https://git.kernel.org/stable/c/140cfd9980124aecb6c03ef2e69c72d0548744de ↗
- https://git.kernel.org/stable/c/ad53127973034c63b5348715a1043d0e80ceb330 ↗
- https://git.kernel.org/stable/c/2d59a0ed8b26b8f3638d8afc31f839e27759f1f6 ↗
- https://git.kernel.org/stable/c/7ed9d238c7dbb1fdb63ad96a6184985151b0171c ↗