diff --git a/patches.suse/mm-fix-mremap-not-considering-huge-pmd-devmap.patch b/patches.suse/mm-fix-mremap-not-considering-huge-pmd-devmap.patch new file mode 100644 index 0000000..138e7e0 --- /dev/null +++ b/patches.suse/mm-fix-mremap-not-considering-huge-pmd-devmap.patch @@ -0,0 +1,51 @@ +From: Fan Yang +Date: Wed, 3 Jun 2020 14:14:45 +0800 +Subject: [PATCH v2] mm: Fix mremap not considering huge pmd devmap +Patch-mainline: not yet, under embargo +References: bsc#1172317, CVE-2020-10757 + +The original code in mm/mremap.c checks huge pmd by: + + if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd)) { + +However, a DAX mapped nvdimm is mapped as huge page (by default) but +it is not transparent huge page (_PAGE_PSE | PAGE_DEVMAP). This +commit changes the condition to include the case. + +This addresses CVE-2020-10757. + +Fixes: 5c7fb56e5e3f ("mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd") +Cc: +Reported-by: Fan Yang +Signed-off-by: Fan Yang +Tested-by: Fan Yang +Tested-by: Dan Williams +Reviewed-by: Dan Williams +Acked-by: Michal Hocko + +--- + arch/x86/include/asm/pgtable.h | 1 + + mm/mremap.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -253,6 +253,7 @@ static inline int pmd_large(pmd_t pte) + } + + #ifdef CONFIG_TRANSPARENT_HUGEPAGE ++/* NOTE: when predicate huge page, consider also pmd_devmap, or use pmd_large */ + static inline int pmd_trans_huge(pmd_t pmd) + { + return (pmd_val(pmd) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE; +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -266,7 +266,7 @@ unsigned long move_page_tables(struct vm + new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr); + if (!new_pmd) + break; +- if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd)) { ++ if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd) || pmd_devmap(*old_pmd)) { + if (extent == HPAGE_PMD_SIZE) { + bool moved; + /* See comment in move_ptes() */ diff --git a/series.conf b/series.conf index 80eee4a..5d22b37 100644 --- a/series.conf +++ b/series.conf @@ -12199,6 +12199,8 @@ patches.suse/mm-Warn-users-of-node-memory-hot-remove-if-the-memory-ratio-is-a-high-risk.patch patches.suse/selftests-vm-drop-dependencies-on-page-flags-from-mlock2-tests.patch + patches.suse/mm-fix-mremap-not-considering-huge-pmd-devmap.patch + ######################################################## # Filesystems ########################################################