CVE-2024-27022

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fork: defer linking file vma until vma is fully initialized<br /> <br /> Thorvald reported a WARNING [1]. And the root cause is below race:<br /> <br /> CPU 1 CPU 2<br /> fork hugetlbfs_fallocate<br /> dup_mmap hugetlbfs_punch_hole<br /> i_mmap_lock_write(mapping);<br /> vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.<br /> i_mmap_unlock_write(mapping);<br /> hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!<br /> i_mmap_lock_write(mapping);<br /> hugetlb_vmdelete_list<br /> vma_interval_tree_foreach<br /> hugetlb_vma_trylock_write -- Vma_lock is cleared.<br /> tmp-&gt;vm_ops-&gt;open -- Alloc new vma_lock outside i_mmap_rwsem!<br /> hugetlb_vma_unlock_write -- Vma_lock is assigned!!!<br /> i_mmap_unlock_write(mapping);<br /> <br /> hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside<br /> i_mmap_rwsem lock while vma lock can be used in the same time. Fix this<br /> by deferring linking file vma until vma is fully initialized. Those vmas<br /> should be initialized first before they can be used.