In the Linux kernel, the following vulnerability has been resolved:
mm: memory-failure: update ttu flag inside unmappoisonedfolio
Patch series "mm: memory_failure: unmap poisoned folio during migrate properly", v3.
Fix two bugs during folio migration if the folio is poisoned.
This patch (of 3):
Commit 6da6b1d4a7df ("mm/hwpoison: convert TTUIGNOREHWPOISON to TTUHWPOISON") introduce TTUHWPOISON to replace TTUIGNOREHWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory error on a clean folio. However during page migration, anon folio must be set with TTUHWPOISON during unmap*(). For pagecache we need some policy just like the one in hwpoisonusermappings to set this flag. So move this policy from hwpoisonusermappings to unmappoisonedfolio to handle this warning properly.
Warning will be produced during unamp poison folio with the following log:
------------[ cut here ]------------ WARNING: CPU: 1 PID: 365 at mm/rmap.c:1847 trytounmapone+0x8fc/0xd3c Modules linked in: CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G W 6.13.0-rc1-00018-gacdb4bbda7ab #42 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : trytounmapone+0x8fc/0xd3c lr : trytounmapone+0x3dc/0xd3c Call trace: trytounmapone+0x8fc/0xd3c (P) trytounmapone+0x3dc/0xd3c (L) rmapwalkanon+0xdc/0x1f8 rmapwalk+0x3c/0x58 trytounmap+0x88/0x90 unmappoisonedfolio+0x30/0xa8 domigraterange+0x4a0/0x568 offlinepages+0x5a4/0x670 memoryblockaction+0x17c/0x374 memorysubsysoffline+0x3c/0x78 deviceoffline+0xa4/0xd0 statestore+0x8c/0xf0 devattrstore+0x18/0x2c sysfskfwrite+0x44/0x54 kernfsfopwriteiter+0x118/0x1a8 vfswrite+0x3a8/0x4bc ksyswrite+0x6c/0xf8 _arm64syswrite+0x1c/0x28 invokesyscall+0x44/0x100 el0svccommon.constprop.0+0x40/0xe0 doel0svc+0x1c/0x28 el0svc+0x30/0xd0 el0t64synchandler+0xc8/0xcc el0t64sync+0x198/0x19c ---[ end trace 0000000000000000 ]---
[mawupeng1@huawei.com: unmappoisonedfolio(): remove shadowed local `mapping', per Miaohe]
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81679b1633aa43c0d973adfa816d78c1ed0d032",
"deprecated": false,
"id": "CVE-2025-21907-019fee69",
"signature_type": "Function",
"digest": {
"length": 1705.0,
"function_hash": "269549823826464083431168919374943836902"
},
"target": {
"function": "do_migrate_range",
"file": "mm/memory_hotplug.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@608cc7deb428f1122ed426060233622ebf667b6e",
"deprecated": false,
"id": "CVE-2025-21907-23298648",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27154361380909701590004524959494946992",
"298721175504710660714223377653655828092",
"47869345157554794599981161194484484697",
"91560847876785515563852951158711510094"
]
},
"target": {
"file": "mm/memory_hotplug.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425c12c076e6fc6b2cb04b9f960319d31dcabc76",
"deprecated": false,
"id": "CVE-2025-21907-2e74a36d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265634198857292286622829570362323655894",
"317708652987001939892805702690807846927",
"293282259348620874741303021685923673437",
"89700064842017812600668476481437899468",
"71553773890268963212889486619844468474",
"168122409463151707699543685613244661654",
"102591802622147510766444955569493691455",
"27133860822851157550873235462252273556",
"103248965178948158113545150157500144716"
]
},
"target": {
"file": "mm/internal.h"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425c12c076e6fc6b2cb04b9f960319d31dcabc76",
"deprecated": false,
"id": "CVE-2025-21907-321c1c6c",
"signature_type": "Function",
"digest": {
"length": 369.0,
"function_hash": "193169668004688693852293141893940082145"
},
"target": {
"function": "unmap_poisoned_folio",
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425c12c076e6fc6b2cb04b9f960319d31dcabc76",
"deprecated": false,
"id": "CVE-2025-21907-32aa3f2a",
"signature_type": "Function",
"digest": {
"length": 1703.0,
"function_hash": "126750181650974146497096352465733161934"
},
"target": {
"function": "do_migrate_range",
"file": "mm/memory_hotplug.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@608cc7deb428f1122ed426060233622ebf667b6e",
"deprecated": false,
"id": "CVE-2025-21907-3c644d99",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265634198857292286622829570362323655894",
"317708652987001939892805702690807846927",
"293282259348620874741303021685923673437",
"89700064842017812600668476481437899468",
"12459566195877817734382241940310528676",
"249620276548194981778731132478957752362",
"102591802622147510766444955569493691455",
"27133860822851157550873235462252273556",
"103248965178948158113545150157500144716"
]
},
"target": {
"file": "mm/internal.h"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81679b1633aa43c0d973adfa816d78c1ed0d032",
"deprecated": false,
"id": "CVE-2025-21907-6505a760",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265634198857292286622829570362323655894",
"317708652987001939892805702690807846927",
"293282259348620874741303021685923673437",
"89700064842017812600668476481437899468",
"71553773890268963212889486619844468474",
"168122409463151707699543685613244661654",
"102591802622147510766444955569493691455",
"27133860822851157550873235462252273556",
"103248965178948158113545150157500144716"
]
},
"target": {
"file": "mm/internal.h"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425c12c076e6fc6b2cb04b9f960319d31dcabc76",
"deprecated": false,
"id": "CVE-2025-21907-73bb4e94",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27154361380909701590004524959494946992",
"298721175504710660714223377653655828092",
"47869345157554794599981161194484484697",
"91560847876785515563852951158711510094"
]
},
"target": {
"file": "mm/memory_hotplug.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425c12c076e6fc6b2cb04b9f960319d31dcabc76",
"deprecated": false,
"id": "CVE-2025-21907-8b0e5b4b",
"signature_type": "Function",
"digest": {
"length": 1259.0,
"function_hash": "246826043910903856873031562471050780041"
},
"target": {
"function": "hwpoison_user_mappings",
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81679b1633aa43c0d973adfa816d78c1ed0d032",
"deprecated": false,
"id": "CVE-2025-21907-97b64778",
"signature_type": "Function",
"digest": {
"length": 1259.0,
"function_hash": "246826043910903856873031562471050780041"
},
"target": {
"function": "hwpoison_user_mappings",
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@608cc7deb428f1122ed426060233622ebf667b6e",
"deprecated": false,
"id": "CVE-2025-21907-9a4c898b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"199836057269286841193761975676536082968",
"153780239463039754140798054778119812779",
"118594358062207044075768197113414233826",
"331055357245192903583070287720235765265",
"327024939805186110429203767379952147973",
"51117399845009836679032202696708491529",
"143072875312167702294075327266543868748",
"24322646242005049317022881152588597437",
"297057818167715486915792600250784625865",
"146133301229427865703545359079415856813",
"189623790087260333497528949910747958162",
"188247695867023708469132738663238973263",
"110291188444020838357934218555855505884",
"195069371778415911952372943118813034957",
"286520477375501616651088021207079407903",
"108165184796273826188790261061999977441",
"191926192032201134991919313675889975494",
"133349170697040157469404785562084074352",
"118951374021392612636942291385616597661",
"142046626077836930907898905394394529715",
"40604870366153218636009471934161119019",
"247563891737891845865767600683445112479",
"27376242652187504781967523049889706476",
"214580230139793073269039199568543549411",
"205873798347822782613620307412251925928",
"251395604199523809406037267054477190114",
"197179244582910078714484171919938565788",
"66440624122283382296130307388603495014",
"327267944663429469649296859484749527061",
"311536959193206425274585453113461445530",
"133399774944936538353552131725297074880",
"283786433598731122082921985814736489881",
"2545877451926650725046767066785381437",
"189161621113076924917888569153121341044",
"107157608034346392668818230382924256601",
"271453943096772983825919685639829526909",
"298843024482408841855642088442500948790",
"24777379125230864960118593783378524651",
"337781624777140029427654294363998776330",
"85917575874819902367388187284981373718",
"277853363251866053816363656282044315576"
]
},
"target": {
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@608cc7deb428f1122ed426060233622ebf667b6e",
"deprecated": false,
"id": "CVE-2025-21907-a5a434ec",
"signature_type": "Function",
"digest": {
"length": 369.0,
"function_hash": "193169668004688693852293141893940082145"
},
"target": {
"function": "unmap_poisoned_folio",
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81679b1633aa43c0d973adfa816d78c1ed0d032",
"deprecated": false,
"id": "CVE-2025-21907-b7044415",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27154361380909701590004524959494946992",
"298721175504710660714223377653655828092",
"47869345157554794599981161194484484697",
"91560847876785515563852951158711510094"
]
},
"target": {
"file": "mm/memory_hotplug.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@608cc7deb428f1122ed426060233622ebf667b6e",
"deprecated": false,
"id": "CVE-2025-21907-ca438a42",
"signature_type": "Function",
"digest": {
"length": 1259.0,
"function_hash": "246826043910903856873031562471050780041"
},
"target": {
"function": "hwpoison_user_mappings",
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81679b1633aa43c0d973adfa816d78c1ed0d032",
"deprecated": false,
"id": "CVE-2025-21907-ca6ad73f",
"signature_type": "Function",
"digest": {
"length": 369.0,
"function_hash": "193169668004688693852293141893940082145"
},
"target": {
"function": "unmap_poisoned_folio",
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@608cc7deb428f1122ed426060233622ebf667b6e",
"deprecated": false,
"id": "CVE-2025-21907-e1b1ead6",
"signature_type": "Function",
"digest": {
"length": 1703.0,
"function_hash": "126750181650974146497096352465733161934"
},
"target": {
"function": "do_migrate_range",
"file": "mm/memory_hotplug.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b81679b1633aa43c0d973adfa816d78c1ed0d032",
"deprecated": false,
"id": "CVE-2025-21907-fb66e0e3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"199836057269286841193761975676536082968",
"153780239463039754140798054778119812779",
"118594358062207044075768197113414233826",
"331055357245192903583070287720235765265",
"327024939805186110429203767379952147973",
"51117399845009836679032202696708491529",
"143072875312167702294075327266543868748",
"24322646242005049317022881152588597437",
"297057818167715486915792600250784625865",
"146133301229427865703545359079415856813",
"189623790087260333497528949910747958162",
"188247695867023708469132738663238973263",
"110291188444020838357934218555855505884",
"195069371778415911952372943118813034957",
"286520477375501616651088021207079407903",
"108165184796273826188790261061999977441",
"191926192032201134991919313675889975494",
"133349170697040157469404785562084074352",
"118951374021392612636942291385616597661",
"142046626077836930907898905394394529715",
"40604870366153218636009471934161119019",
"247563891737891845865767600683445112479",
"27376242652187504781967523049889706476",
"214580230139793073269039199568543549411",
"205873798347822782613620307412251925928",
"251395604199523809406037267054477190114",
"197179244582910078714484171919938565788",
"66440624122283382296130307388603495014",
"327267944663429469649296859484749527061",
"311536959193206425274585453113461445530",
"133399774944936538353552131725297074880",
"283786433598731122082921985814736489881",
"2545877451926650725046767066785381437",
"189161621113076924917888569153121341044",
"107157608034346392668818230382924256601",
"271453943096772983825919685639829526909",
"298843024482408841855642088442500948790",
"24777379125230864960118593783378524651",
"337781624777140029427654294363998776330",
"85917575874819902367388187284981373718",
"277853363251866053816363656282044315576"
]
},
"target": {
"file": "mm/memory-failure.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425c12c076e6fc6b2cb04b9f960319d31dcabc76",
"deprecated": false,
"id": "CVE-2025-21907-fb69176d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"199836057269286841193761975676536082968",
"153780239463039754140798054778119812779",
"118594358062207044075768197113414233826",
"331055357245192903583070287720235765265",
"327024939805186110429203767379952147973",
"51117399845009836679032202696708491529",
"143072875312167702294075327266543868748",
"24322646242005049317022881152588597437",
"297057818167715486915792600250784625865",
"146133301229427865703545359079415856813",
"189623790087260333497528949910747958162",
"188247695867023708469132738663238973263",
"110291188444020838357934218555855505884",
"195069371778415911952372943118813034957",
"286520477375501616651088021207079407903",
"108165184796273826188790261061999977441",
"191926192032201134991919313675889975494",
"133349170697040157469404785562084074352",
"118951374021392612636942291385616597661",
"142046626077836930907898905394394529715",
"40604870366153218636009471934161119019",
"247563891737891845865767600683445112479",
"27376242652187504781967523049889706476",
"214580230139793073269039199568543549411",
"205873798347822782613620307412251925928",
"251395604199523809406037267054477190114",
"197179244582910078714484171919938565788",
"66440624122283382296130307388603495014",
"327267944663429469649296859484749527061",
"311536959193206425274585453113461445530",
"133399774944936538353552131725297074880",
"283786433598731122082921985814736489881",
"2545877451926650725046767066785381437",
"189161621113076924917888569153121341044",
"107157608034346392668818230382924256601",
"271453943096772983825919685639829526909",
"298843024482408841855642088442500948790",
"24777379125230864960118593783378524651",
"337781624777140029427654294363998776330",
"85917575874819902367388187284981373718",
"277853363251866053816363656282044315576"
]
},
"target": {
"file": "mm/memory-failure.c"
}
}
]