High · published February 26, 2025
In the Linux kernel, the following vulnerability has been resolved:
zsmalloc: fix races between asynchronous zspage free and page migration
The asynchronous zspage free worker tries to lock a zspage's entire page
list without defending against page migration. Since pages which haven't
yet been locked can concurrently migrate off the zspage page list while
lock_zspage() churns away, lock_zspage() can suffer from a few different
lethal races.
It can lock a page which no longer belongs to the zspage and unsafely
dereference page_private(), it can unsafely dereference a torn pointer to
the next page (since there's a data race), and it can observe a spurious
NULL pointer to the next page and thus not lock all of the zspage's pages
(since a single page migration will reconstruct the entire page list, and
create_page_chain() unconditionally zeroes out each list pointer in the
process).
Fix the races by using migrate_read_lock() in lock_zspage() to synchronize
with page migration.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.14, < 4.14.282 | 4.14.282 |
| linux/linux_kernel | ≥ 4.15, < 4.19.246 | 4.19.246 |
| linux/linux_kernel | ≥ 4.20, < 5.4.197 | 5.4.197 |
| linux/linux_kernel | ≥ 5.5, < 5.10.120 | 5.10.120 |
| linux/linux_kernel | ≥ 5.11, < 5.15.45 | 5.15.45 |
| linux/linux_kernel | ≥ 5.16, < 5.17.13 | 5.17.13 |
| linux/linux_kernel | ≥ 5.18, < 5.18.2 | 5.18.2 |