CVE-2024-39298: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages
In the Linux kernel, the following vulnerability has been resolved:
mm/memory-failure: fix handling of dissolved but not taken off from buddy pages
The Linux kernel CVE team has assigned CVE-2024-39298 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024062549-CVE-2024-39298-53e8@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
mm/memory-failure: fix handling of dissolved but not taken off from buddy pages
When I did memory failure tests recently, below panic occurs:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8cee00 flags: 0x6fffe0000000000(node=1|zone=2|lastcpupid=0x7fff) raw: 06fffe0000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000009 00000000ffffffff 0000000000000000 page dumped because: VMBUGONPAGE(!PageBuddy(page)) ------------[ cut here ]------------ kernel BUG at include/linux/page-flags.h:1009! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:delpagefromfreelist+0x151/0x180 RSP: 0018:ffffa49c90437998 EFLAGS: 00000046 RAX: 0000000000000035 RBX: 0000000000000009 RCX: ffff8dd8dfd1c9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff8dd8dfd1c9c0 RBP: ffffd901233b8000 R08: ffffffffab5511f8 R09: 0000000000008c69 R10: 0000000000003c15 R11: ffffffffab5511f8 R12: ffff8dd8fffc0c80 R13: 0000000000000001 R14: ffff8dd8fffc0c80 R15: 0000000000000009 FS: 00007ff916304740(0000) GS:ffff8dd8dfd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055eae50124c8 CR3: 00000008479e0000 CR4: 00000000000006f0 Call Trace: <TASK> rmqueuepcplist+0x23b/0x520 getpagefromfreelist+0x26b/0xe40 allocpagesnoprof+0x113/0x1120 folioallocnoprof+0x11/0xb0 allocbuddyhugetlbfolio.isra.0+0x5a/0x130 allocfreshhugetlbfolio+0xe7/0x140 allocpoolhugefolio+0x68/0x100 setmaxhugepages+0x13d/0x340 hugetlbsysctlhandlercommon+0xe8/0x110 procsyscallhandler+0x194/0x280 vfswrite+0x387/0x550 ksyswrite+0x64/0xe0 dosyscall64+0xc2/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7ff916114887 RSP: 002b:00007ffec8a2fd78 EFLAGS: 00000246 ORIGRAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055eae500e350 RCX: 00007ff916114887 RDX: 0000000000000004 RSI: 000055eae500e390 RDI: 0000000000000003 RBP: 000055eae50104c0 R08: 0000000000000000 R09: 000055eae50104c0 R10: 0000000000000077 R11: 0000000000000246 R12: 0000000000000004 R13: 0000000000000004 R14: 00007ff916216b80 R15: 00007ff916216a00 </TASK> Modules linked in: mceinject hwpoisoninject ---[ end trace 0000000000000000 ]---
And before the panic, there had an warning about bad page state:
BUG: Bad page state in process page-types pfn:8cee00 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8cee00 flags: 0x6fffe0000000000(node=1|zone=2|lastcpupid=0x7fff) pagetype: 0xffffff7f(buddy) raw: 06fffe0000000000 ffffd901241c0008 ffffd901240f8008 0000000000000000 raw: 0000000000000000 0000000000000009 00000000ffffff7f 0000000000000000 page dumped because: nonzero mapcount Modules linked in: mceinject hwpoisoninject CPU: 8 PID: 154211 Comm: page-types Not tainted 6.9.0-rc4-00499-g5544ec3178e2-dirty #22 Call Trace: <TASK> dumpstacklvl+0x83/0xa0 badpage+0x63/0xf0 freeunrefpage+0x36e/0x5c0 unpoisonmemory+0x50b/0x630 simpleattrwritexsigned.constprop.0.isra.0+0xb3/0x110 debugfsattrwrite+0x42/0x60 fullproxywrite+0x5b/0x80 vfswrite+0xcd/0x550 ksyswrite+0x64/0xe0 dosyscall64+0xc2/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7f189a514887 RSP: 002b:00007ffdcd899718 EFLAGS: 00000246 ORIGRAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f189a514887 RDX: 0000000000000009 RSI: 00007ffdcd899730 RDI: 0000000000000003 RBP: 00007ffdcd8997a0 R08: 0000000000000000 R09: 00007ffdcd8994b2 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcda199a8 R13: 0000000000404af1 R14: 000000000040ad78 R15: 00007f189a7a5040 </TASK>
The root cause should be the below race:
memoryfailure trymemoryfailurehugetlb mehugepage pagehandlepoison dissolvefreehugetlbfolio drainallpages -- Buddy page can be isolated e.g. for compaction. takepageoffbuddy -- Failed as page is not in the ---truncated---
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39298?
CVE-2024-39298 has been classified as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2024-39298?
To address CVE-2024-39298, users should upgrade the Linux kernel to version 6.1.95, 6.6.35, 6.9.5, 6.10, or specific 5.10 and 6.1 versions as recommended by their distribution.
Which versions of the Linux kernel are affected by CVE-2024-39298?
CVE-2024-39298 affects various kernel versions prior to 6.1.95, 6.6.35, 6.9.5, and 6.10, along with several specific earlier releases.
What impact does CVE-2024-39298 have on the Linux kernel?
CVE-2024-39298 affects memory handling within the Linux kernel, specifically related to events where buddy pages are dissolved but not properly managed.
Is there a workaround for CVE-2024-39298?
Currently, there are no specific workarounds recommended for CVE-2024-39298; upgrading the kernel is advised for full mitigation.