Description
In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock. migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() <- Takes folio_lock! -> remove_migration_ptes() -> __rmap_walk_file() -> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)! hugetlbfs_fallocate() -> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)! -> hugetlbfs_zero_partial_page() -> filemap_lock_hugetlb_folio() -> filemap_lock_folio() -> __filemap_get_folio <- Waits for folio_lock! The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too. This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
336bf30eb76580b579dc711ded5d599d905c0217 to < e7396d23f9d5739f56cf9ab430c3a169f5508394affected336bf30eb76580b579dc711ded5d599d905c0217 to < ad97b9a55246eb940a26ac977f80892a395cabf9affected336bf30eb76580b579dc711ded5d599d905c0217 to < 5edb9854f8df5428b40990a1c7d60507da5bd330affected336bf30eb76580b579dc711ded5d599d905c0217 to < 526394af4e8ade89cacd1a9ce2b97712712fcc34affected336bf30eb76580b579dc711ded5d599d905c0217 to < b75070823b89009f5123fd0e05a8e0c3d39937c1affected336bf30eb76580b579dc711ded5d599d905c0217 to < 1b68efce6dd483d22f50d0d3800c4cfda14b1305affected336bf30eb76580b579dc711ded5d599d905c0217 to < b7880cb166ab62c2409046b2347261abf701530eaffectedef792d6ce0db6a56e56743b1de1716a982c3b851affected5.9.9 to < 5.10affected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected5.10.249 to ≤ 5.10.*unaffected5.15.199 to ≤ 5.15.*unaffected6.1.162 to ≤ 6.1.*unaffected6.6.122 to ≤ 6.6.*unaffected6.12.68 to ≤ 6.12.*unaffected6.18.8 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e7396d23f9d5739f56cf9ab430c3a169f5508394 ↗
- https://git.kernel.org/stable/c/ad97b9a55246eb940a26ac977f80892a395cabf9 ↗
- https://git.kernel.org/stable/c/5edb9854f8df5428b40990a1c7d60507da5bd330 ↗
- https://git.kernel.org/stable/c/526394af4e8ade89cacd1a9ce2b97712712fcc34 ↗
- https://git.kernel.org/stable/c/b75070823b89009f5123fd0e05a8e0c3d39937c1 ↗
- https://git.kernel.org/stable/c/1b68efce6dd483d22f50d0d3800c4cfda14b1305 ↗
- https://git.kernel.org/stable/c/b7880cb166ab62c2409046b2347261abf701530e ↗