Description
In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the folio instead of forcibly unmapping it when writeback completes. For a mapped folio, folio_unmap_invalidate() can call unmap_mapping_folio(), which takes i_mmap_rwsem and may sleep. Retaining mapped folios avoids this path when folio_end_dropbehind() runs in non-preemptible task context. Tal was able to trigger a sleeping-in-atomic warning due to this [1]. Unmapped dropbehind folios continue through the existing invalidation path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fb7d3bc4149395c1ae99029c852eab6c28fc3c88 to < 2897601dffe576fcd87a4259102f41f7fb0cbfc8affectedfb7d3bc4149395c1ae99029c852eab6c28fc3c88 to < 77c0fade37c80e8aa16ac048a9828249055e3f66affectedfb7d3bc4149395c1ae99029c852eab6c28fc3c88 to < 848d2ce2fce15fbdc083fbf9691bfa72911033c4affected
Linux Linux
Default version status: affected
6.14affected0 to < 6.14unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected