{"cve":"CVE-2021-47531","nvd":{"published":"2024-05-24T15:15:16.357","modified":"2026-06-17T04:17:42.267","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix mmap to include VM_IO and VM_DONTDUMP\n\nIn commit 510410bfc034 (\"drm/msm: Implement mmap as GEM object\nfunction\") we switched to a new/cleaner method of doing things. That's\ngood, but we missed a little bit.\n\nBefore that commit, we used to _first_ run through the\ndrm_gem_mmap_obj() case where `obj->funcs->mmap()` was NULL. That meant\nthat we ran:\n\n  vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;\n  vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));\n  vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);\n\n...and _then_ we modified those mappings with our own. Now that\n`obj->funcs->mmap()` is no longer NULL we don't run the default\ncode. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP\nwas important because we're now getting crashes on Chromebooks that\nuse ARC++ while logging out. Specifically a crash that looks like this\n(this is on a 5.10 kernel w/ relevant backports but also seen on a\n5.15 kernel):\n\n  Unable to handle kernel paging request at virtual address ffffffc008000000\n  Mem abort info:\n    ESR = 0x96000006\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n  Data abort info:\n    ISV = 0, ISS = 0x00000006\n    CM = 0, WnR = 0\n  swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000008293d000\n  [ffffffc008000000] pgd=00000001002b3003, p4d=00000001002b3003,\n                     pud=00000001002b3003, pmd=0000000000000000\n  Internal error: Oops: 96000006 [#1] PREEMPT SMP\n  [...]\n  CPU: 7 PID: 15734 Comm: crash_dump64 Tainted: G W 5.10.67 #1 [...]\n  Hardware name: Qualcomm Technologies, Inc. sc7280 IDP SKU2 platform (DT)\n  pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)\n  pc : __arch_copy_to_user+0xc0/0x30c\n  lr : copyout+0xac/0x14c\n  [...]\n  Call trace:\n   __arch_copy_to_user+0xc0/0x30c\n   copy_page_to_iter+0x1a0/0x294\n   process_vm_rw_core+0x240/0x408\n   process_vm_rw+0x110/0x16c\n   __arm64_sys_process_vm_readv+0x30/0x3c\n   el0_svc_common+0xf8/0x250\n   do_el0_svc+0x30/0x80\n   el0_svc+0x10/0x1c\n   el0_sync_handler+0x78/0x108\n   el0_sync+0x184/0x1c0\n  Code: f8408423 f80008c3 910020c6 36100082 (b8404423)\n\nLet's add the two flags back in.\n\nWhile we're at it, the fact that we aren't running the default means\nthat we _don't_ need to clear out VM_PFNMAP, so remove that and save\nan instruction.\n\nNOTE: it was confirmed that VM_IO was the important flag to fix the\nproblem I was seeing, but adding back VM_DONTDUMP seems like a sane\nthing to do so I'm doing that too.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786","https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba","https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786","https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:50:30.954589733+00:00"},"epss":{"cve":"CVE-2021-47531","score":0.00205,"percentile":0.10546,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}