Description
In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races. It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process). Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
77ff465799c60294e248000cd22ae8171da3304c to < 3674d8a8dadd03a447dd21069d4dacfc3399b63baffected77ff465799c60294e248000cd22ae8171da3304c to < 645996efc2ae391246d595832aaa6f9d3cc338c7affected77ff465799c60294e248000cd22ae8171da3304c to < fc658c083904427abbf8f18280d517ee2668677caffected77ff465799c60294e248000cd22ae8171da3304c to < fae05b2314b147a78fbed1dc4c645d9a66313758affected77ff465799c60294e248000cd22ae8171da3304c to < 3ec459c8810e658401be428d3168eacfc380bdd0affected77ff465799c60294e248000cd22ae8171da3304c to < 8ba7b7c1dad1f6503c541778f31b33f7f62eb966affected77ff465799c60294e248000cd22ae8171da3304c to < c5402fb5f71f1a725f1e55d9c6799c0c7bec308faffected77ff465799c60294e248000cd22ae8171da3304c to < 2505a981114dcb715f8977b8433f7540854851d8affected
Linux Linux
Default version status: affected
4.14affected0 to < 4.14unaffected4.14.282 to ≤ 4.14.*unaffected4.19.246 to ≤ 4.19.*unaffected5.4.197 to ≤ 5.4.*unaffected5.10.120 to ≤ 5.10.*unaffected5.15.45 to ≤ 5.15.*unaffected5.17.13 to ≤ 5.17.*unaffected5.18.2 to ≤ 5.18.*unaffected5.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3674d8a8dadd03a447dd21069d4dacfc3399b63b ↗
- https://git.kernel.org/stable/c/645996efc2ae391246d595832aaa6f9d3cc338c7 ↗
- https://git.kernel.org/stable/c/fc658c083904427abbf8f18280d517ee2668677c ↗
- https://git.kernel.org/stable/c/fae05b2314b147a78fbed1dc4c645d9a66313758 ↗
- https://git.kernel.org/stable/c/3ec459c8810e658401be428d3168eacfc380bdd0 ↗
- https://git.kernel.org/stable/c/8ba7b7c1dad1f6503c541778f31b33f7f62eb966 ↗
- https://git.kernel.org/stable/c/c5402fb5f71f1a725f1e55d9c6799c0c7bec308f ↗
- https://git.kernel.org/stable/c/2505a981114dcb715f8977b8433f7540854851d8 ↗