摘要:
In the Linux kernel, the following vulnerability has been resolved:ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabledThe debugging code for kmap_local() doubles the number of per-CPU fixmapslots allocated for kmap_local(), in order to use half of them as guardregions. This causes the fixmap region to grow downwards beyond the startof its reserved window if the supported number of CPUs is large, and collidewith the newly added virtual DT mapping right below it, which is obviouslynot good.One manifestation of this is EFI boot on a kernel built with NR_CPUS=32and CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resultingin block entries below the fixmap region that the fixmap code misidentifiesas fixmap table entries, and subsequently tries to dereference using aphys-to-virt translation that is only valid for lowmem. This results in acryptic splat such as the one below. ftrace: allocating 45548 entries in 89 pages 8<--- cut here --- Unable to handle kernel paging request at virtual address fc6006f0 pgd = (ptrval) [fc6006f0] *pgd=80000040207003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382 Hardware name: Generic DT based system PC is at cpu_ca15_set_pte_ext+0x24/0x30 LR is at __set_fixmap+0xe4/0x118 pc : [<c041ac9c>] lr : [<c04189d8>] psr: 400000d3 sp : c1601ed8 ip : 00400000 fp : 00800000 r10: 0000071f r9 : 00421000 r8 : 00c00000 r7 : 00c00000 r6 : 0000071f r5 : ffade000 r4 : 4040171f r3 : 00c00000 r2 : 4040171f r1 : c041ac78 r0 : fc6006f0 Flags: nZcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 40203000 DAC: 00000001 Process swapper (pid: 0, stack limit = 0x(ptrval))So let s limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also,fix the BUILD_BUG_ON() check that was supposed to catch this, by checkingwhether the region grows below the start address rather than above the endaddress.
安全等级: Low
公告ID: KylinSec-SA-2024-2256
发布日期: 2024年5月27日
关联CVE: CVE-2021-46910
In the Linux kernel, the following vulnerability has been resolved:ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabledThe debugging code for kmap_local() doubles the number of per-CPU fixmapslots allocated for kmap_local(), in order to use half of them as guardregions. This causes the fixmap region to grow downwards beyond the startof its reserved window if the supported number of CPUs is large, and collidewith the newly added virtual DT mapping right below it, which is obviouslynot good.One manifestation of this is EFI boot on a kernel built with NR_CPUS=32and CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resultingin block entries below the fixmap region that the fixmap code misidentifiesas fixmap table entries, and subsequently tries to dereference using aphys-to-virt translation that is only valid for lowmem. This results in acryptic splat such as the one below. ftrace: allocating 45548 entries in 89 pages 8<--- cut here --- Unable to handle kernel paging request at virtual address fc6006f0 pgd = (ptrval) [fc6006f0] *pgd=80000040207003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382 Hardware name: Generic DT based system PC is at cpu_ca15_set_pte_ext+0x24/0x30 LR is at __set_fixmap+0xe4/0x118 pc : [<c041ac9c>] lr : [<c04189d8>] psr: 400000d3 sp : c1601ed8 ip : 00400000 fp : 00800000 r10: 0000071f r9 : 00421000 r8 : 00c00000 r7 : 00c00000 r6 : 0000071f r5 : ffade000 r4 : 4040171f r3 : 00c00000 r2 : 4040171f r1 : c041ac78 r0 : fc6006f0 Flags: nZcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 40203000 DAC: 00000001 Process swapper (pid: 0, stack limit = 0x(ptrval))So let s limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also,fix the BUILD_BUG_ON() check that was supposed to catch this, by checkingwhether the region grows below the start address rather than above the endaddress.
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2021-46910 | KY3.4-4A | kernel | Unaffected |
| CVE-2021-46910 | KY3.4-5 | kernel | Unaffected |
| CVE-2021-46910 | KY3.5.1 | kernel | Unaffected |
