Description
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() syzbot reported a sleeping function called from invalid context splat in bucket_table_alloc(). When rhashtable_insert_slow() rehashes the table under rcu_read_lock(), it calls bucket_table_alloc(..., GFP_ATOMIC | __GFP_NOWARN). If the bucket table allocation uses vmalloc, __vmalloc_node_range_noprof() invokes vm_area_alloc_pages() -> alloc_pages_bulk_mempolicy_noprof() with the passed GFP_ATOMIC flags. If the current task has an MPOL_WEIGHTED_INTERLEAVE mempolicy, alloc_pages_bulk_weighted_interleave() is called and currently hardcodes GFP_KERNEL when allocating the temporary weights array, triggering a might_alloc() splat in atomic/RCU contexts. Pass the gfp flags (masked with GFP_RECLAIM_MASK to strip page-allocator zone modifiers like __GFP_HIGHMEM) received by alloc_pages_bulk_weighted_interleave() to kmalloc() instead of hardcoding GFP_KERNEL. Since the weights buffer is immediately initialized in full, kmalloc() is sufficient.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fa3bea4e1f8202d787709b7e3654eb0a99aed758 to < bcb3d0c867ee40dc48e9c085bf328fbc679b6656affectedfa3bea4e1f8202d787709b7e3654eb0a99aed758 to < 0ceda28f371df9e0bbdaa29214f71fe8298f23d8affectedfa3bea4e1f8202d787709b7e3654eb0a99aed758 to < 2943f1f4b7f2816177060eb9f551f2e6d8b629baaffectedfa3bea4e1f8202d787709b7e3654eb0a99aed758 to < 540e583b66d6402bf556fde5e53c817a54c1afe5affected
Linux Linux
Default version status: affected
6.9affected0 to < 6.9unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected