CVE-2022-49081

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> highmem: fix checks in __kmap_local_sched_{in,out}<br /> <br /> When CONFIG_DEBUG_KMAP_LOCAL is enabled __kmap_local_sched_{in,out} check<br /> that even slots in the tsk-&gt;kmap_ctrl.pteval are unmapped. The slots are<br /> initialized with 0 value, but the check is done with pte_none. 0 pte<br /> however does not necessarily mean that pte_none will return true. e.g.<br /> on xtensa it returns false, resulting in the following runtime warnings:<br /> <br /> WARNING: CPU: 0 PID: 101 at mm/highmem.c:627 __kmap_local_sched_out+0x51/0x108<br /> CPU: 0 PID: 101 Comm: touch Not tainted 5.17.0-rc7-00010-gd3a1cdde80d2-dirty #13<br /> Call Trace:<br /> dump_stack+0xc/0x40<br /> __warn+0x8f/0x174<br /> warn_slowpath_fmt+0x48/0xac<br /> __kmap_local_sched_out+0x51/0x108<br /> __schedule+0x71a/0x9c4<br /> preempt_schedule_irq+0xa0/0xe0<br /> common_exception_return+0x5c/0x93<br /> do_wp_page+0x30e/0x330<br /> handle_mm_fault+0xa70/0xc3c<br /> do_page_fault+0x1d8/0x3c4<br /> common_exception+0x7f/0x7f<br /> <br /> WARNING: CPU: 0 PID: 101 at mm/highmem.c:664 __kmap_local_sched_in+0x50/0xe0<br /> CPU: 0 PID: 101 Comm: touch Tainted: G W 5.17.0-rc7-00010-gd3a1cdde80d2-dirty #13<br /> Call Trace:<br /> dump_stack+0xc/0x40<br /> __warn+0x8f/0x174<br /> warn_slowpath_fmt+0x48/0xac<br /> __kmap_local_sched_in+0x50/0xe0<br /> finish_task_switch$isra$0+0x1ce/0x2f8<br /> __schedule+0x86e/0x9c4<br /> preempt_schedule_irq+0xa0/0xe0<br /> common_exception_return+0x5c/0x93<br /> do_wp_page+0x30e/0x330<br /> handle_mm_fault+0xa70/0xc3c<br /> do_page_fault+0x1d8/0x3c4<br /> common_exception+0x7f/0x7f<br /> <br /> Fix it by replacing !pte_none(pteval) with pte_val(pteval) != 0.