From 81c7ae47f2a7099e3deada5ad07dd2f9e3b9ab8b Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Tue, 26 Aug 2025 14:11:38 +0800 Subject: [PATCH] mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race mainline inclusion from mainline-v6.16-rc1 commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICIQAF CVE: CVE-2025-38085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1013af4f585fccc4d3e5c5824d174de2257f7d6d -------------------------------- huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse. Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-2-1329349bad1a@google.com Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-2-f4136f5ec58a@google.com Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Jann Horn Reviewed-by: Lorenzo Stoakes Cc: Liam Howlett Cc: Muchun Song Cc: Oscar Salvador Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Conflicts: mm/hugetlb.c [Context conflicts.] Signed-off-by: Jinjiang Tu --- mm/hugetlb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bed9f05ecaf1..32b7ee895315 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6001,6 +6001,13 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, return 0; pud_clear(pud); + /* + * Once our caller drops the rmap lock, some other process might be + * using this page table as a normal, non-hugetlb page table. + * Wait for pending gup_fast() in other threads to finish before letting + * that happen. + */ + tlb_remove_table_sync_one(); put_page(virt_to_page(ptep)); mm_dec_nr_pmds(mm); /* -- Gitee