In the Linux kernel, the following vulnerability has been resolved:
mm: fix unexpected zeroed page mapping with zram swap
Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly.
CPU A CPU B
doswappage doswappage SWPSYNCHRONOUSIO path SWPSYNCHRONOUSIO path swapreadpage valid data swapslotfreenotify delete zram entry swapreadpage zeroed(invalid) data ptelock map the zero data to userspace pteunlock ptelock if (!ptesame) goto outnomap; pte_unlock return and next refault will read zeroed data
The swapslotfreenotify is bogus for CLONEVM case since it doesn't increase the refcount of swap slot at copymm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swapslotfreenotify function. With this patch, CPU A will see correct data.
CPU A CPU B
doswappage doswappage SWPSYNCHRONOUSIO path SWPSYNCHRONOUSIO path swapreadpage original data ptelock map the original data swapfree swaprangefree bddisk->fops->swapslotfreenotify swapreadpage read zeroed data pteunlock ptelock if (!ptesame) goto outnomap; pte_unlock return on next refault will see mapped data by CPU B
The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and doswappage is followed by swap_free so it will free the compressed form from in zram quickly.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e914d8f00391520ecc4495dd0ca0124538ab7119",
"id": "CVE-2022-49052-0b85ae4c",
"deprecated": false,
"target": {
"function": "swap_slot_free_notify",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 460.0,
"function_hash": "241204156780362944267040362133662671943"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20ed94f8181a25212e7404e44958e234f407624b",
"id": "CVE-2022-49052-286a2710",
"deprecated": false,
"target": {
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232866889122152705817839975492703903889",
"58788218849967657125432833759384954515",
"6428748565242437641584105850854852617",
"109247842059212461264768770045405838674",
"189197163693310973089110246926942541505",
"260454595098420751981853185694917094308",
"144439458268195091564899538197102730005",
"147478022131937094399940047024607503486",
"136317331429378681623992659877194430911",
"190367858178609539101086884951392138166",
"155932923013794421743540874005800888423",
"87542044553386895069080888771932140403",
"170626860567305044283095487637829764722",
"279451171314395439308923553479406343234",
"105722175474353252759526668020694661791",
"338827727680807173377755015687710670150",
"332744300347926507615485395361604291539",
"175911078785935190537653036039142018654",
"10074040723374779398285949861489324658",
"116700384845715049003640122654991148475",
"315021605935632976738712841122926814742",
"25352458517792359895693674378365766986",
"152529244565840198297036427314154157911",
"19239885886871654252214693657865980715",
"17568735328924335954245886991792228405",
"103167613105138477864492023455513188688",
"151183580896414017740738819497660331412",
"130456032035071821799498325357261768549",
"333803194584934272841188117610658841338",
"100060362549364806026210931484615261148",
"107313641741655482715552185184649612331",
"123407173360096750776357562688588708542",
"143512067277526725246388548045160064274",
"145727509609033613387925625428242941948"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afac4b88699a06c8b9369f9d759a1ec3c254b788",
"id": "CVE-2022-49052-2de87b3d",
"deprecated": false,
"target": {
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232866889122152705817839975492703903889",
"58788218849967657125432833759384954515",
"6428748565242437641584105850854852617",
"109247842059212461264768770045405838674",
"189197163693310973089110246926942541505",
"260454595098420751981853185694917094308",
"144439458268195091564899538197102730005",
"147478022131937094399940047024607503486",
"136317331429378681623992659877194430911",
"190367858178609539101086884951392138166",
"155932923013794421743540874005800888423",
"87542044553386895069080888771932140403",
"170626860567305044283095487637829764722",
"279451171314395439308923553479406343234",
"105722175474353252759526668020694661791",
"338827727680807173377755015687710670150",
"332744300347926507615485395361604291539",
"175911078785935190537653036039142018654",
"10074040723374779398285949861489324658",
"116700384845715049003640122654991148475",
"315021605935632976738712841122926814742",
"25352458517792359895693674378365766986",
"152529244565840198297036427314154157911",
"19239885886871654252214693657865980715",
"17568735328924335954245886991792228405",
"103167613105138477864492023455513188688",
"151183580896414017740738819497660331412",
"130456032035071821799498325357261768549",
"333803194584934272841188117610658841338",
"100060362549364806026210931484615261148",
"107313641741655482715552185184649612331",
"123407173360096750776357562688588708542",
"143512067277526725246388548045160064274",
"145727509609033613387925625428242941948"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e914d8f00391520ecc4495dd0ca0124538ab7119",
"id": "CVE-2022-49052-31424e5c",
"deprecated": false,
"target": {
"function": "swap_readpage",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1523.0,
"function_hash": "273600520385712662409594108419106140871"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afac4b88699a06c8b9369f9d759a1ec3c254b788",
"id": "CVE-2022-49052-33b6b92a",
"deprecated": false,
"target": {
"function": "swap_slot_free_notify",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 460.0,
"function_hash": "241204156780362944267040362133662671943"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f86d55cf616199404c05f5b0c5c41b17351baa02",
"id": "CVE-2022-49052-435b19dd",
"deprecated": false,
"target": {
"function": "end_swap_bio_read",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 533.0,
"function_hash": "260131853646937674317888857742098246163"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12ba1d38115a101c45d8e0ca3aa1181fd148e57f",
"id": "CVE-2022-49052-51cd3bc6",
"deprecated": false,
"target": {
"function": "swap_readpage",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1549.0,
"function_hash": "301174538400495671254636215239630258591"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f098f8b9820fe3f2e41aefc4329dfe8a3859d1c1",
"id": "CVE-2022-49052-6a017647",
"deprecated": false,
"target": {
"function": "swap_slot_free_notify",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 447.0,
"function_hash": "139851152488185343392924238289862910876"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20ed94f8181a25212e7404e44958e234f407624b",
"id": "CVE-2022-49052-73d5bdc3",
"deprecated": false,
"target": {
"function": "swap_readpage",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1467.0,
"function_hash": "334386753243256791562060158798875566506"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12ba1d38115a101c45d8e0ca3aa1181fd148e57f",
"id": "CVE-2022-49052-7434bf1d",
"deprecated": false,
"target": {
"function": "swap_slot_free_notify",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 460.0,
"function_hash": "241204156780362944267040362133662671943"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afac4b88699a06c8b9369f9d759a1ec3c254b788",
"id": "CVE-2022-49052-77b8c906",
"deprecated": false,
"target": {
"function": "end_swap_bio_read",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 548.0,
"function_hash": "121205563755128371955614648001296254049"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f098f8b9820fe3f2e41aefc4329dfe8a3859d1c1",
"id": "CVE-2022-49052-79077269",
"deprecated": false,
"target": {
"function": "swap_readpage",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1344.0,
"function_hash": "124597358540252294214894641025409658042"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f098f8b9820fe3f2e41aefc4329dfe8a3859d1c1",
"id": "CVE-2022-49052-7adcf59a",
"deprecated": false,
"target": {
"function": "end_swap_bio_read",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 548.0,
"function_hash": "121205563755128371955614648001296254049"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f86d55cf616199404c05f5b0c5c41b17351baa02",
"id": "CVE-2022-49052-8bd42686",
"deprecated": false,
"target": {
"function": "swap_slot_free_notify",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 453.0,
"function_hash": "271284421621584088730123452728182906160"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12ba1d38115a101c45d8e0ca3aa1181fd148e57f",
"id": "CVE-2022-49052-93008091",
"deprecated": false,
"target": {
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232866889122152705817839975492703903889",
"58788218849967657125432833759384954515",
"6428748565242437641584105850854852617",
"109247842059212461264768770045405838674",
"189197163693310973089110246926942541505",
"260454595098420751981853185694917094308",
"144439458268195091564899538197102730005",
"147478022131937094399940047024607503486",
"136317331429378681623992659877194430911",
"190367858178609539101086884951392138166",
"155932923013794421743540874005800888423",
"87542044553386895069080888771932140403",
"170626860567305044283095487637829764722",
"279451171314395439308923553479406343234",
"105722175474353252759526668020694661791",
"338827727680807173377755015687710670150",
"332744300347926507615485395361604291539",
"175911078785935190537653036039142018654",
"10074040723374779398285949861489324658",
"116700384845715049003640122654991148475",
"315021605935632976738712841122926814742",
"25352458517792359895693674378365766986",
"152529244565840198297036427314154157911",
"19239885886871654252214693657865980715",
"17568735328924335954245886991792228405",
"103167613105138477864492023455513188688",
"151183580896414017740738819497660331412",
"130456032035071821799498325357261768549",
"333803194584934272841188117610658841338",
"100060362549364806026210931484615261148",
"107313641741655482715552185184649612331",
"123407173360096750776357562688588708542",
"143512067277526725246388548045160064274",
"145727509609033613387925625428242941948"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f86d55cf616199404c05f5b0c5c41b17351baa02",
"id": "CVE-2022-49052-b11b02c5",
"deprecated": false,
"target": {
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232866889122152705817839975492703903889",
"58788218849967657125432833759384954515",
"6428748565242437641584105850854852617",
"109247842059212461264768770045405838674",
"189197163693310973089110246926942541505",
"260454595098420751981853185694917094308",
"144439458268195091564899538197102730005",
"147478022131937094399940047024607503486",
"320905263735533706361726664252157424896",
"25110131942392942481134111001054306390",
"208785257221352632775189919737498325714",
"85751415594662249009529420387463209916",
"201534352119261801546569879377434579842",
"160045835182262288743283649829467868959",
"12612255117662548324296225670143806229",
"309015116787469502866697215028937993054",
"129556067342497179539415587734581280037",
"332744300347926507615485395361604291539",
"175911078785935190537653036039142018654",
"10074040723374779398285949861489324658",
"116700384845715049003640122654991148475",
"315021605935632976738712841122926814742",
"25352458517792359895693674378365766986",
"152529244565840198297036427314154157911",
"19239885886871654252214693657865980715",
"17568735328924335954245886991792228405",
"103167613105138477864492023455513188688",
"151183580896414017740738819497660331412",
"209962431398433574892551853927607651192",
"306326000629793326772288906650940023394",
"100060362549364806026210931484615261148",
"107313641741655482715552185184649612331",
"123407173360096750776357562688588708542",
"202725130418022574986516528462858995852",
"217392488786303240227470661956874348770"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e914d8f00391520ecc4495dd0ca0124538ab7119",
"id": "CVE-2022-49052-b8fb633b",
"deprecated": false,
"target": {
"function": "end_swap_bio_read",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 548.0,
"function_hash": "121205563755128371955614648001296254049"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f86d55cf616199404c05f5b0c5c41b17351baa02",
"id": "CVE-2022-49052-bd8299f8",
"deprecated": false,
"target": {
"function": "swap_readpage",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1302.0,
"function_hash": "270421454137764303354935602156022025877"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20ed94f8181a25212e7404e44958e234f407624b",
"id": "CVE-2022-49052-bed95fb6",
"deprecated": false,
"target": {
"function": "swap_slot_free_notify",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 460.0,
"function_hash": "241204156780362944267040362133662671943"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20ed94f8181a25212e7404e44958e234f407624b",
"id": "CVE-2022-49052-c3d84784",
"deprecated": false,
"target": {
"function": "end_swap_bio_read",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 548.0,
"function_hash": "121205563755128371955614648001296254049"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12ba1d38115a101c45d8e0ca3aa1181fd148e57f",
"id": "CVE-2022-49052-c6026948",
"deprecated": false,
"target": {
"function": "end_swap_bio_read",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 548.0,
"function_hash": "121205563755128371955614648001296254049"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afac4b88699a06c8b9369f9d759a1ec3c254b788",
"id": "CVE-2022-49052-ddf17023",
"deprecated": false,
"target": {
"function": "swap_readpage",
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1503.0,
"function_hash": "307723791181854849824918369523696676919"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f098f8b9820fe3f2e41aefc4329dfe8a3859d1c1",
"id": "CVE-2022-49052-e0331681",
"deprecated": false,
"target": {
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232866889122152705817839975492703903889",
"58788218849967657125432833759384954515",
"6428748565242437641584105850854852617",
"109247842059212461264768770045405838674",
"189197163693310973089110246926942541505",
"260454595098420751981853185694917094308",
"144439458268195091564899538197102730005",
"147478022131937094399940047024607503486",
"320905263735533706361726664252157424896",
"25110131942392942481134111001054306390",
"208785257221352632775189919737498325714",
"85751415594662249009529420387463209916",
"170626860567305044283095487637829764722",
"279451171314395439308923553479406343234",
"105722175474353252759526668020694661791",
"338827727680807173377755015687710670150",
"332744300347926507615485395361604291539",
"175911078785935190537653036039142018654",
"10074040723374779398285949861489324658",
"116700384845715049003640122654991148475",
"315021605935632976738712841122926814742",
"25352458517792359895693674378365766986",
"152529244565840198297036427314154157911",
"19239885886871654252214693657865980715",
"17568735328924335954245886991792228405",
"103167613105138477864492023455513188688",
"151183580896414017740738819497660331412",
"226375268236888375423126675155967094155",
"333803194584934272841188117610658841338",
"100060362549364806026210931484615261148",
"107313641741655482715552185184649612331",
"123407173360096750776357562688588708542",
"202725130418022574986516528462858995852",
"217392488786303240227470661956874348770"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e914d8f00391520ecc4495dd0ca0124538ab7119",
"id": "CVE-2022-49052-ff99841e",
"deprecated": false,
"target": {
"file": "mm/page_io.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"232866889122152705817839975492703903889",
"58788218849967657125432833759384954515",
"6428748565242437641584105850854852617",
"109247842059212461264768770045405838674",
"189197163693310973089110246926942541505",
"260454595098420751981853185694917094308",
"144439458268195091564899538197102730005",
"147478022131937094399940047024607503486",
"136317331429378681623992659877194430911",
"190367858178609539101086884951392138166",
"155932923013794421743540874005800888423",
"87542044553386895069080888771932140403",
"170626860567305044283095487637829764722",
"279451171314395439308923553479406343234",
"105722175474353252759526668020694661791",
"338827727680807173377755015687710670150",
"332744300347926507615485395361604291539",
"175911078785935190537653036039142018654",
"10074040723374779398285949861489324658",
"116700384845715049003640122654991148475",
"315021605935632976738712841122926814742",
"25352458517792359895693674378365766986",
"152529244565840198297036427314154157911",
"19239885886871654252214693657865980715",
"17568735328924335954245886991792228405",
"103167613105138477864492023455513188688",
"151183580896414017740738819497660331412",
"130456032035071821799498325357261768549",
"333803194584934272841188117610658841338",
"100060362549364806026210931484615261148",
"107313641741655482715552185184649612331",
"123407173360096750776357562688588708542",
"143512067277526725246388548045160064274",
"145727509609033613387925625428242941948"
]
}
}
]