RHEL8: kernel panic with include/linux/swapops.h:216

Issue

• What is CVE-2023-4732.
• Kernel panic with log:

[ 9306.167830] kernel BUG at include/linux/swapops.h:216!
[ 9306.198629] invalid opcode: 0000 [#1] SMP NOPTI
[ 9306.225760] CPU: 15 PID: 672706 Comm: stress-ng Kdump: loaded Tainted: G           O     --------- -  - 4.18.0-477.15.1.el8_8.x86_64 #1
[ 9306.298670] Hardware name: FUJITSU PRIMERGY RX2540 M5/D3384-B1, BIOS V5.0.0.14 R1.32.0 for D3384-B1x                    06/10/2022
[ 9306.368968] RIP: 0010:zap_huge_pmd+0x35f/0x370
[ 9306.395576] Code: e0 e8 f0 49 81 84 07 d8 02 00 00 00 fe ff ff e9 bc fe ff ff 48 8b 55 08 48 8d 42 ff 83 e2 01 48 0f 44 c5 48 8b 00 a8 01 75 ac <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00
[ 9306.508019] RSP: 0018:ffffb1641d487c60 EFLAGS: 00010246
[ 9306.539301] RAX: 00d7ffffc0000000 RBX: ffffb1641d487de8 RCX: 0000000000000000
[ 9306.582030] RDX: 0000000000000000 RSI: 0000000000000002 RDI: e7fffff37c63fa00
[ 9306.624777] RBP: fffff5aed0738080 R08: 0000000000000000 R09: 00000000013a7000
[ 9306.667513] R10: 0000000000000000 R11: 0000000000000000 R12: ffff961cbcdf0038
[ 9306.710251] R13: fffff5af95f37c28 R14: ffff9618abb55960 R15: 0000000000e00000
[ 9306.752982] FS:  0000000000000000(0000) GS:ffff9646bfd80000(0000) knlGS:0000000000000000
[ 9306.801441] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9306.835848] CR2: 00007fdb6e64b940 CR3: 0000006995e10002 CR4: 00000000007706e0
[ 9306.878581] PKRU: 55555554
[ 9306.894792] Call Trace:
[ 9306.909429]  unmap_page_range+0xce7/0xf40
[ 9306.933443]  unmap_vmas+0xc0/0xe0
[ 9306.953283]  ? lru_add_drain_cpu+0x88/0x130
[ 9306.978330]  exit_mmap+0x9d/0x170
[ 9306.998179]  mmput+0x58/0x130
[ 9307.015937]  do_exit+0x2fb/0xb00
[ 9307.035269]  ? syscall_trace_enter+0x1ff/0x2d0
[ 9307.061881]  do_group_exit+0x3a/0xa0
[ 9307.083280]  __x64_sys_exit_group+0x14/0x20
[ 9307.108328]  do_syscall_64+0x5b/0x1b0
[ 9307.130244]  entry_SYSCALL_64_after_hwframe+0x61/0xc6

• Another pattern of panic log:

[  637.483844] ------------[ cut here ]------------
[  637.500021] kernel BUG at include/linux/swapops.h:216!
[  637.505262] invalid opcode: 0000 [#1] SMP NOPTI
[  637.509887] CPU: 59 PID: 16799 Comm: stress-ng Kdump: loaded Not tainted 4.18.0-477.15.1.el8_8.x86_64 #1
[  637.519449] Hardware name: Intel Corporation ............/S9200WKBRD2, BIOS SE5C620.86B.0D.01.0552.060220191912 06/02/2019
[  637.530531] RIP: 0010:page_vma_mapped_walk+0x893/0x8a0
[  637.535688] Code: ff e9 6b fe ff ff 48 8b 05 ba a4 72 01 e9 85 fe ff ff 48 8b 05 ae a4 72 01 e9 15 fe ff ff 4c 8b 35 a2 a4 72 01 e9 75 fb ff ff <0f> 0b 48 8d 51 ff e9 2a ff ff ff 66 90 0f 1f 44 00 00 55 48 89 f5
[  637.554441] RSP: 0000:ffffb628d686ba60 EFLAGS: 00010246
[  637.559677] RAX: ffffedc4a2828080 RBX: ffffb628d686ba90 RCX: 0000000000000000
[  637.566824] RDX: 0057ffffc0000000 RSI: 0000000000000000 RDI: e7fffffcebebfa00
[  637.573959] RBP: 0000561d81400000 R08: 0000000000000002 R09: 70000000001ebe00
[  637.581092] R10: 0000000000000002 R11: 0000000000002da6 R12: ffff9d8708fb7800
[  637.588225] R13: ffffedc447af8000 R14: ffffedc4448cb968 R15: 7c00000000000000
[  637.595358] FS:  00007f6794199740(0000) GS:ffff9dcddf4c0000(0000) knlGS:0000000000000000
[  637.603452] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  637.609198] CR2: 0000561d80d8d3d0 CR3: 000000015efee001 CR4: 00000000007706e0
[  637.616329] PKRU: 55555554
[  637.619043] Call Trace:
[  637.621498]  remove_migration_pte+0x7f/0x420
[  637.625779]  rmap_walk_anon+0xe7/0x290
[  637.629538]  remove_migration_ptes+0x71/0x80
[  637.633820]  ? migrate_page_copy+0x3b0/0x3b0
[  637.638103]  migrate_pages+0x8fd/0xb80
[  637.641860]  ? migrate_page_states+0x260/0x260
[  637.646308]  migrate_to_node+0xea/0x130
[  637.650158]  do_migrate_pages.part.41+0x1f3/0x260
[  637.654874]  kernel_migrate_pages+0x406/0x440
[  637.659242]  __x64_sys_migrate_pages+0x1a/0x30
[  637.663693]  do_syscall_64+0x5b/0x1b0
[  637.667369]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[  637.672430] RIP: 0033:0x7f67932169bd
[  637.676010] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 9b 64 38 00 f7 d8 64 89 01 48
[  637.694763] RSP: 002b:00007fffe7d238b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000100
[  637.702337] RAX: ffffffffffffffda RBX: 00007fffe7d238c0 RCX: 00007f67932169bd
[  637.709471] RDX: 00007fffe7d258c0 RSI: 0000000000000400 RDI: 000000000000419f
[  637.716602] RBP: 00007fffe7d27e30 R08: 00000000ffffffff R09: 00007f678e678000
[  637.723735] R10: 00007fffe7d25ac0 R11: 0000000000000246 R12: 00007fffe7d25cc0
[  637.730869] R13: 0000000000001000 R14: 0000000000000400 R15: 00007fffe7d25ac0

• Another pattern of panic log:

[  490.951343] kernel BUG at include/linux/swapops.h:204!
[  490.951350] invalid opcode: 0000 [#1] SMP NOPTI
[  490.951353] CPU: 99 PID: 40114 Comm: stress-ng Kdump: loaded Not tainted 4.18.0-348.23.1.el8_5.x86_64 #1
[  490.951354] Hardware name: Intel Corporation ............/S9200WKBRD2, BIOS SE5C620.86B.0D.01.0552.060220191912 06/02/2019
[  490.951363] RIP: 0010:pmd_migration_entry_wait+0x175/0x190
[  490.951365] Code: 34 75 14 48 89 df c6 07 00 0f 1f 40 00 5b 48 89 d7 5d e9 0e 53 f7 ff 85 c0 0f 84 09 ff ff ff 8d 70 01 f0 0f b1 31 74 db eb ed <0f> 0b 48 8b 1d 22 2e 31 01 e9 ac fe ff ff 66 66 2e 0f 1f 84 00 00
[  490.951367] RSP: 0000:ffffb061d7b6fdd8 EFLAGS: 00010246
[  490.951368] RAX: 00d7ffffc0048018 RBX: ffffe19fc51885a8 RCX: 0000000000000000
[  490.951369] RDX: ffffe1a0e2d60080 RSI: ffffe1a0e1fb3a47 RDI: e7fffff6e94ffa00
[  490.951370] RBP: ffff88da06216598 R08: ffff88da0620bcb8 R09: 0000000000000000
[  490.951371] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000598
[  490.951372] R13: 0000000000000001 R14: 000055c3567d81d0 R15: ffff88daa3d93180
[  490.951374] FS:  00007f3156263740(0000) GS:ffff88f0a0cc0000(0000) knlGS:0000000000000000
[  490.951375] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  490.951376] CR2: 000055c3567d81d0 CR3: 0000000146218003 CR4: 00000000007706e0
[  490.951377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  490.951378] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  490.951378] PKRU: 55555554
[  490.951379] Call Trace:
[  490.951388]  __handle_mm_fault+0x7c6/0x820
[  490.951391]  handle_mm_fault+0xbe/0x1e0
[  490.951396]  __do_page_fault+0x1ed/0x4c0
[  490.951399]  do_page_fault+0x37/0x130
[  490.951405]  ? page_fault+0x8/0x30
[  490.951406]  page_fault+0x1e/0x30