APPLIED: [SRU][J][PATCH 0/1] CVE-2024-40915

[Stefan Bader]

On 16.09.24 21:29, Bethany Jamison wrote:
> [Impact]
> 
> riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
> __kernel_map_pages() is a debug function which clears the valid bit in page
> table entry for deallocated pages to detect illegal memory accesses to
> freed pages.
> 
> This function set/clear the valid bit using __set_memory(). __set_memory()
> acquires init_mm's semaphore, and this operation may sleep. This is
> problematic, because  __kernel_map_pages() can be called in atomic context,
> and thus is illegal to sleep.
> 
> Rewrite this function with apply_to_existing_page_range(). It is fine to
> not have any locking, because __kernel_map_pages() works with pages being
> allocated/deallocated and those pages are not changed by anyone else in the
> meantime.
> 
> [Fix]
> 
> Noble:	released
> Jammy:	Clean cherry-pick
> Focal:	not-affected
> Bionic:	not-affected
> Xenial:	not-affected
> Trusty:	not-affected
> 
> [Test Case]
> 
> Compile tested.
> 
> [Where problems could occur]
> 
> This fix affects those who use pages with riscv, an issue with this fix
> would be visible to the user via unpredicted system behavior or a system
> crash.
> 
> Nam Cao (1):
>    riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
> 
>   arch/riscv/mm/pageattr.c | 28 ++++++++++++++++++++++------
>   1 file changed, 22 insertions(+), 6 deletions(-)
> 

Applied to jammy:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240925/fa3235bd/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240925/fa3235bd/attachment-0001.sig>