CVE-2022-49081

highmem: fix checks in __kmap_local_sched_{in,out}

published February 26, 2025

CVSS
—
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

highmem: fix checks in __kmap_local_sched_{in,out}

When CONFIG_DEBUG_KMAP_LOCAL is enabled __kmap_local_sched_{in,out} check

that even slots in the tsk->kmap_ctrl.pteval are unmapped. The slots are

initialized with 0 value, but the check is done with pte_none. 0 pte

however does not necessarily mean that pte_none will return true. e.g.

on xtensa it returns false, resulting in the following runtime warnings:

WARNING: CPU: 0 PID: 101 at mm/highmem.c:627 __kmap_local_sched_out+0x51/0x108

CPU: 0 PID: 101 Comm: touch Not tainted 5.17.0-rc7-00010-gd3a1cdde80d2-dirty #13

Call Trace:

dump_stack+0xc/0x40

__warn+0x8f/0x174

warn_slowpath_fmt+0x48/0xac

__kmap_local_sched_out+0x51/0x108

__schedule+0x71a/0x9c4

preempt_schedule_irq+0xa0/0xe0

common_exception_return+0x5c/0x93

do_wp_page+0x30e/0x330

handle_mm_fault+0xa70/0xc3c

do_page_fault+0x1d8/0x3c4

common_exception+0x7f/0x7f

WARNING: CPU: 0 PID: 101 at mm/highmem.c:664 __kmap_local_sched_in+0x50/0xe0

CPU: 0 PID: 101 Comm: touch Tainted: G W 5.17.0-rc7-00010-gd3a1cdde80d2-dirty #13

Call Trace:

dump_stack+0xc/0x40

__warn+0x8f/0x174

warn_slowpath_fmt+0x48/0xac

__kmap_local_sched_in+0x50/0xe0

finish_task_switch$isra$0+0x1ce/0x2f8

__schedule+0x86e/0x9c4

preempt_schedule_irq+0xa0/0xe0

common_exception_return+0x5c/0x93

do_wp_page+0x30e/0x330

handle_mm_fault+0xa70/0xc3c

do_page_fault+0x1d8/0x3c4

common_exception+0x7f/0x7f

Fix it by replacing !pte_none(pteval) with pte_val(pteval) != 0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Published
2025-02-26T01:54Z
EPSS history
Timeline
  • 26 FEB 01:54Z
    highmem: fix checks in __kmap_local_sched_{in,out}
    cvelistv5