KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
exploitation probability
0.2%top 89% of all CVEs
observed exploitation
nono source reports it
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
The account_mem() and unaccount_mem() functions call get_uid() which
increments the reference count of struct user_struct on every invocation.
But we don't decrement the count by calling free_uid(). It also
accounted/unaccounted the pages against the current->mm. But its possible
the unaccount_mem() can be called from a different process context than the
one that originally pinned the pages.
Let's fix this by storing the pinning process user_struct and mm_struct
when accounting for pinned pages, and subsequently free these resources
when the pages are unpinned.
[borntraeger@linux.ibm.com: Fixed whitespace]
Affected products
Linux · LinuxReferences
https://git.kernel.org/stable/c/36f6999ecde3976731a8bfc0b8e667da6f593069https://git.kernel.org/stable/c/47cfd75d9df7c8f425b0d769328fe43a8a8e606ehttps://git.kernel.org/stable/c/70871b121f81d08879363cb1238a4c85c5c2800chttps://git.kernel.org/stable/c/ad1c2ac7f15b224cf9ab26b593caa9bd1a4be72ehttps://git.kernel.org/stable/c/dc7465a364104526c56b922c9de9dfcc08a7d5f7https://git.kernel.org/stable/c/e3f732e086e438c52c7400bd2734bb166aa4752c