Description
In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug We miss a failed allocation check for pgdat->per_cpu_nodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats so a later online can retry the allocation. hotadd_init_pgdat() returns NULL on failure, which __try_online_node() already maps to -ENOMEM. On failure nothing needs to be unwound: - the node is never marked online - per_cpu_nodestats is left pointing at boot_nodestats - __add_memory_resource() cleans up pending memblock resources - later online attempts retry the per_cpu_nodestats allocation
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
75ef7184053989118d3814c558a9af62e7376a58 to < 4dda09e7ca0bf0c3fa7c5c8f134d9804b67f455caffected75ef7184053989118d3814c558a9af62e7376a58 to < 4cc5caef9a8d1894dfa31d84a0daa0ac1437dadcaffected75ef7184053989118d3814c558a9af62e7376a58 to < bc3b5e6519b8df22d622a03eab6772784da97db4affected75ef7184053989118d3814c558a9af62e7376a58 to < 1017fe1c7f48e511c5a680e3057005daaff2f3a2affected75ef7184053989118d3814c558a9af62e7376a58 to < 2ebce860bdd7ae5e13002811bc9bbbf33fcfc221affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected6.6.160 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4dda09e7ca0bf0c3fa7c5c8f134d9804b67f455c ↗
- https://git.kernel.org/stable/c/4cc5caef9a8d1894dfa31d84a0daa0ac1437dadc ↗
- https://git.kernel.org/stable/c/bc3b5e6519b8df22d622a03eab6772784da97db4 ↗
- https://git.kernel.org/stable/c/1017fe1c7f48e511c5a680e3057005daaff2f3a2 ↗
- https://git.kernel.org/stable/c/2ebce860bdd7ae5e13002811bc9bbbf33fcfc221 ↗