Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer mappings, this results in ring_buffer_unmap() being called multiple times while ring_buffer_map() was only called once. This causes ring_buffer_unmap() to return -ENODEV on subsequent calls because user_mapped is already 0, triggering a WARN_ON. Trace buffer mappings cannot support partial mappings because the ring buffer structure requires the complete buffer including the meta page. Fix this by adding a may_split callback that returns -EINVAL to prevent VMA splits entirely.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 to < 922fdd0b755a84f9933b3ca195f60092b6bb88eeaffectedcf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 to < 45053c12c45f0fb8ef6ab95118dd928d2fec0255affectedcf9f0f7c4c5bb45e7bb270e48bab6f7837825a64 to < b042fdf18e89a347177a49e795d8e5184778b5b6affected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.12.61 to ≤ 6.12.*unaffected6.17.11 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected