CVE-2024-45022

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0<br /> <br /> The __vmap_pages_range_noflush() assumes its argument pages** contains<br /> pages with the same page shift. However, since commit e9c3cda4d86e ("mm,<br /> vmalloc: fix high order __GFP_NOFAIL allocations"), if gfp_flags includes<br /> __GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation<br /> failed for high order, the pages** may contain two different page shifts<br /> (high order and order-0). This could lead __vmap_pages_range_noflush() to<br /> perform incorrect mappings, potentially resulting in memory corruption.<br /> <br /> Users might encounter this as follows (vmap_allow_huge = true, 2M is for<br /> PMD_SIZE):<br /> <br /> kvmalloc(2M, __GFP_NOFAIL|GFP_X)<br /> __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)<br /> vm_area_alloc_pages(order=9) ---&gt; order-9 allocation failed and fallback to order-0<br /> vmap_pages_range()<br /> vmap_pages_range_noflush()<br /> __vmap_pages_range_noflush(page_shift = 21) ----&gt; wrong mapping happens<br /> <br /> We can remove the fallback code because if a high-order allocation fails,<br /> __vmalloc_node_range_noprof() will retry with order-0. Therefore, it is<br /> unnecessary to fallback to order-0 here. Therefore, fix this by removing<br /> the fallback code.