CVE-2024-53105: mm: page_alloc: move mlocked flag clearance into free_pages_prepare()

In the Linux kernel, the following vulnerability has been resolved:

mm: pagealloc: move mlocked flag clearance into freepagesprepare()

Syzbot reported a bad page state problem caused by a page being freed using freepage() still having a mlocked flag at freepagesprepare() stage:

BUG: Bad page state in process syz.5.504 pfn:61f45 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45 flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGEFLAGSCHECKATFREE flag(s) set pageowner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfpmask 0x400dc0(GFPKERNELACCOUNT|GFPZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, freets 201499827394 setpageowner include/linux/pageowner.h:32 [inline] postallochook+0x1f3/0x230 mm/pagealloc.c:1537 prepnewpage mm/pagealloc.c:1545 [inline] getpagefromfreelist+0x303f/0x3190 mm/pagealloc.c:3457 allocpagesnoprof+0x292/0x710 mm/pagealloc.c:4733 allocpagesmpolnoprof+0x3e8/0x680 mm/mempolicy.c:2265 kvmcoalescedmmioinit+0x1f/0xf0 virt/kvm/coalescedmmio.c:99 kvmcreatevm virt/kvm/kvmmain.c:1235 [inline] kvmdevioctlcreatevm virt/kvm/kvmmain.c:5488 [inline] kvmdevioctl+0x12dc/0x2240 virt/kvm/kvmmain.c:5530 docompatsysioctl fs/ioctl.c:1007 [inline] secompatsysioctl+0x510/0xc90 fs/ioctl.c:950 dosyscall32irqson arch/x86/entry/common.c:165 [inline] dofastsyscall32+0xb4/0x110 arch/x86/entry/common.c:386 dofastsyscall32+0x34/0x80 arch/x86/entry/common.c:411 entrySYSENTERcompatafterhwframe+0x84/0x8e page last free pid 8399 tgid 8399 stack trace: resetpageowner include/linux/pageowner.h:25 [inline] freepagesprepare mm/pagealloc.c:1108 [inline] freeunreffolios+0xf12/0x18d0 mm/pagealloc.c:2686 foliosputrefs+0x76c/0x860 mm/swap.c:1007 freepagesandswapcache+0x5c8/0x690 mm/swapstate.c:335 tlbbatchfreeencodedpages mm/mmugather.c:136 [inline] tlbbatchpagesflush mm/mmugather.c:149 [inline] tlbflushmmufree mm/mmugather.c:366 [inline] tlbflushmmu+0x3a3/0x680 mm/mmugather.c:373 tlbfinishmmu+0xd4/0x200 mm/mmugather.c:465 exitmmap+0x496/0xc40 mm/mmap.c:1926 mmput+0x115/0x390 kernel/fork.c:1348 exitmm+0x220/0x310 kernel/exit.c:571 doexit+0x9b2/0x28e0 kernel/exit.c:926 dogroupexit+0x207/0x2c0 kernel/exit.c:1088 dosysexitgroup kernel/exit.c:1099 [inline] sesysexitgroup kernel/exit.c:1097 [inline] x64sysexitgroup+0x3f/0x40 kernel/exit.c:1097 x64syscall+0x2634/0x2640 arch/x86/include/generated/asm/syscalls64.h:232 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 badpage+0x176/0x1d0 mm/pagealloc.c:501 freepageisbad mm/pagealloc.c:918 [inline] freepagesprepare mm/pagealloc.c:1100 [inline] freeunrefpage+0xed0/0xf20 mm/pagealloc.c:2638 kvmdestroyvm virt/kvm/kvmmain.c:1327 [inline] kvmputkvm+0xc75/0x1350 virt/kvm/kvmmain.c:1386 kvmvcpurelease+0x54/0x60 virt/kvm/kvmmain.c:4143 fput+0x23f/0x880 fs/filetable.c:431 taskworkrun+0x24f/0x310 kernel/taskwork.c:239 exittaskwork include/linux/taskwork.h:43 [inline] doexit+0xa2f/0x28e0 kernel/exit.c:939 dogroupexit+0x207/0x2c0 kernel/exit.c:1088 dosysexitgroup kernel/exit.c:1099 [in ---truncated---

— NVD

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad