In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify During our test, it is found that a warning can be trigger in trygrabfolio as follow: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 trygrabfolio+0x106/0x130 Modules linked in: CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef) RIP: 0010:trygrabfolio+0x106/0x130 Call Trace: <TASK> followhugepmd+0x240/0x8e0 followpmdmask.constprop.0.isra.0+0x40b/0x5c0 followpudmask.constprop.0.isra.0+0x14a/0x170 followpagemask+0x1c2/0x1f0 _getuserpages+0x176/0x950 _guplongtermlocked+0x15b/0x1060 ? gupfast+0x120/0x1f0 gupfastfallback+0x17e/0x230 getuserpagesfast+0x5f/0x80 vmcihostunlockedioctl+0x21c/0xf80 RIP: 0033:0x54d2cd ---[ end trace 0000000000000000 ]--- Digging into the source, context->notifypage may init by getuserpagesfast and can be seen in vmcictxunsetnotify which will try to putpage. However getuserpagesfast is not finished here and lead to following trygrabfolio warning. The race condition is shown as follow: cpu0 cpu1 vmcihostdosetnotify vmcihostsetupnotify getuserpagesfast(uva, 1, FOLLWRITE, &context->notifypage); locklesspagesfrommm guppgdrange guphugepmd // update &context->notifypage vmcihostdosetnotify vmcictxunsetnotify notifypage = context->notifypage; if (notifypage) putpage(notifypage); // page is freed _guplongtermlocked _getuserpages followtranshugepmd trygrabfolio // warn here To slove this, use local variable page to make notifypage can be seen after finish getuserpages_fast.
{ "binaries": [ { "binary_name": "block-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "block-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "crypto-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "crypto-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "fat-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "fat-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "fb-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "firewire-core-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "floppy-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "fs-core-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "fs-core-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "fs-secondary-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "fs-secondary-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "input-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "input-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "ipmi-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "ipmi-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "irda-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "irda-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "kernel-image-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "kernel-image-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-doc", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-headers-3.11.0-12", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-headers-3.11.0-12-generic", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-headers-3.11.0-12-generic-lpae", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-image-3.11.0-12-generic", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-image-3.11.0-12-generic-lpae", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-image-extra-3.11.0-12-generic", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-libc-dev", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-source-3.11.0", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-tools-3.11.0-12", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-tools-3.11.0-12-generic", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-tools-3.11.0-12-generic-lpae", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-tools-common", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-udebs-generic", "binary_version": "3.11.0-12.19" }, { "binary_name": "linux-udebs-generic-lpae", "binary_version": "3.11.0-12.19" }, { "binary_name": "md-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "md-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "message-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "mouse-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "mouse-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "multipath-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "multipath-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nfs-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nfs-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nic-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nic-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nic-pcmcia-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nic-shared-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nic-shared-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nic-usb-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "nic-usb-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "parport-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "parport-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "pata-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "pcmcia-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "pcmcia-storage-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "plip-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "plip-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "ppp-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "ppp-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "sata-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "sata-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "scsi-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "scsi-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "serial-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "speakup-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "speakup-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "squashfs-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "squashfs-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "storage-core-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "storage-core-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "usb-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "usb-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "virtio-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "vlan-modules-3.11.0-12-generic-di", "binary_version": "3.11.0-12.19" }, { "binary_name": "vlan-modules-3.11.0-12-generic-lpae-di", "binary_version": "3.11.0-12.19" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-image-unsigned-5.15.0-1019-azure-fde", "binary_version": "5.15.0-1019.24~20.04.1.1" }, { "binary_name": "linux-image-unsigned-5.15.0-1019-azure-fde-dbgsym", "binary_version": "5.15.0-1019.24~20.04.1.1" } ], "availability": "No subscription required" }