CVE-2021-47214
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-47214
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-47214.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-47214
- Related
- Published
- 2024-04-10T19:15:48Z
- Modified
- 2024-09-18T01:00:22Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
hugetlb, userfaultfd: fix reservation restore on userfaultfd error
Currently in the iscontinue case in hugetlbmcopyatomicpte(), if we bail out using "goto outreleaseunlock;" in the cases where idx >= size, or !hugeptenone(), the code will detect that newpagecachepage == false, and so call restorereserveonerror(). In this case I see restorereserveonerror() delete the reservation, and the following call to removeinodehugepages() will increment h->resv_hugepages causing a 100% reproducible leak.
We should treat the iscontinue case similar to adding a page into the pagecache and set newpagecachepage to true, to indicate that there is no reservation to restore on the error path, and we need not call restorereserveonerror(). Rename newpagecachepage to pageinpagecache to make that clear.
- References
Affected packages
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source