CVE-2023-53236

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommufd: Do not corrupt the pfn list when doing batch carry<br /> <br /> If batch-&gt;end is 0 then setting npfns[0] before computing the new value of<br /> pfns will fail to adjust the pfn and result in various page accounting<br /> corruptions. It should be ordered after.<br /> <br /> This seems to result in various kinds of page meta-data corruption related<br /> failures:<br /> <br /> WARNING: CPU: 1 PID: 527 at mm/gup.c:75 try_grab_folio+0x503/0x740<br /> Modules linked in:<br /> CPU: 1 PID: 527 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014<br /> RIP: 0010:try_grab_folio+0x503/0x740<br /> Code: e3 01 48 89 de e8 6d c1 dd ff 48 85 db 0f 84 7c fe ff ff e8 4f bf dd ff 49 8d 47 ff 48 89 45 d0 e9 73 fe ff ff e8 3d bf dd ff 0b 31 db e9 d0 fc ff ff e8 2f bf dd ff 48 8b 5d c8 31 ff 48 89<br /> RSP: 0018:ffffc90000f37908 EFLAGS: 00010046<br /> RAX: 0000000000000000 RBX: 00000000fffffc02 RCX: ffffffff81504c26<br /> RDX: 0000000000000000 RSI: ffff88800d030000 RDI: 0000000000000002<br /> RBP: ffffc90000f37948 R08: 000000000003ca24 R09: 0000000000000008<br /> R10: 000000000003ca00 R11: 0000000000000023 R12: ffffea000035d540<br /> R13: 0000000000000001 R14: 0000000000000000 R15: ffffea000035d540<br /> FS: 00007fecbf659740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 00000000200011c3 CR3: 000000000ef66006 CR4: 0000000000770ee0<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> internal_get_user_pages_fast+0xd32/0x2200<br /> pin_user_pages_fast+0x65/0x90<br /> pfn_reader_user_pin+0x376/0x390<br /> pfn_reader_next+0x14a/0x7b0<br /> pfn_reader_first+0x140/0x1b0<br /> iopt_area_fill_domain+0x74/0x210<br /> iopt_table_add_domain+0x30e/0x6e0<br /> iommufd_device_selftest_attach+0x7f/0x140<br /> iommufd_test+0x10ff/0x16f0<br /> iommufd_fops_ioctl+0x206/0x330<br /> __x64_sys_ioctl+0x10e/0x160<br /> do_syscall_64+0x3b/0x90<br /> entry_SYSCALL_64_after_hwframe+0x72/0xdc