CVE-2022-48897

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> arm64/mm: fix incorrect file_map_count for invalid pmd<br /> <br /> The page table check trigger BUG_ON() unexpectedly when split hugepage:<br /> <br /> ------------[ cut here ]------------<br /> kernel BUG at mm/page_table_check.c:119!<br /> Internal error: Oops - BUG: 00000000f2000800 [#1] SMP<br /> Dumping ftrace buffer:<br /> (ftrace buffer empty)<br /> Modules linked in:<br /> CPU: 7 PID: 210 Comm: transhuge-stres Not tainted 6.1.0-rc3+ #748<br /> Hardware name: linux,dummy-virt (DT)<br /> pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> pc : page_table_check_set.isra.0+0x398/0x468<br /> lr : page_table_check_set.isra.0+0x1c0/0x468<br /> [...]<br /> Call trace:<br /> page_table_check_set.isra.0+0x398/0x468<br /> __page_table_check_pte_set+0x160/0x1c0<br /> __split_huge_pmd_locked+0x900/0x1648<br /> __split_huge_pmd+0x28c/0x3b8<br /> unmap_page_range+0x428/0x858<br /> unmap_single_vma+0xf4/0x1c8<br /> zap_page_range+0x2b0/0x410<br /> madvise_vma_behavior+0xc44/0xe78<br /> do_madvise+0x280/0x698<br /> __arm64_sys_madvise+0x90/0xe8<br /> invoke_syscall.constprop.0+0xdc/0x1d8<br /> do_el0_svc+0xf4/0x3f8<br /> el0_svc+0x58/0x120<br /> el0t_64_sync_handler+0xb8/0xc0<br /> el0t_64_sync+0x19c/0x1a0<br /> [...]<br /> <br /> On arm64, pmd_leaf() will return true even if the pmd is invalid due to<br /> pmd_present_invalid() check. So in pmdp_invalidate() the file_map_count<br /> will not only decrease once but also increase once. Then in set_pte_at(),<br /> the file_map_count increase again, and so trigger BUG_ON() unexpectedly.<br /> <br /> Add !pmd_present_invalid() check in pmd_user_accessible_page() to fix the<br /> problem.