CVE-2021-47214

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hugetlb, userfaultfd: fix reservation restore on userfaultfd error

Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we

bail out using "goto out_release_unlock;" in the cases where idx >=

size, or !huge_pte_none(), the code will detect that new_pagecache_page

== false, and so call restore_reserve_on_error(). In this case I see

restore_reserve_on_error() delete the reservation, and the following

call to remove_inode_hugepages() will increment h->resv_hugepages

causing a 100% reproducible leak.

We should treat the is_continue case similar to adding a page into the

pagecache and set new_pagecache_page to true, to indicate that there is

no reservation to restore on the error path, and we need not call

restore_reserve_on_error(). Rename new_pagecache_page to

page_in_pagecache to make that clear.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References