In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one<\/p>\n
Initialize nr_pages to 1 at the start of each loop iteration, like
\nfolio_referenced_one() does.<\/p>\n
Without this, nr_pages computed by a previous folio_unmap_pte_batch() call
\ncan be reused on a later iteration that does not run
\nfolio_unmap_pte_batch() again.<\/p>\n
mmap a 64K large folio with MAP_ANONYMOUS | MAP_DROPPABLE, then call
\nmadvise(MADV_FREE), then make the last page device-exclusive via
\nHMM_DMIRROR_EXCLUSIVE.<\/p>\n
Trigger node reclaim through sysfs. Now, in try_to_unmap_one(), we will
\nfirst clear the first 15 out of 16 entries mapping the lazyfree folio.
\nThis will set nr_pages to 15. In the next pvmw walk, this nr_pages gets
\nreused on a device-exclusive pte, thus potentially corrupting folio
\nrefcount\/mapcount.<\/p>\n
At the moment, I have a userspace program which can make the kernel spit
\nout a trace, but the blow up is in folio_referenced_one(), because there
\nare existing bugs in the interaction between device-private and rmap
\n(which too I am investigating). I did a one liner kernel change to avoid
\ngoing into folio_referenced_one(), and the kernel blows up at
\nfolio_remove_rmap_ptes in try_to_unmap_one which is what I wanted.<\/p>\n
Note that the bug is there not since file folio batching but lazyfree
\nfolio batching, since device-exclusive only works for anonymous folios.<\/p>\n
Userspace visible effect is simply kernel crashing somewhere due to
\nrefcount\/mapcount corruption.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one<\/p>\n
Initialize nr_pages to 1 at the start of each loop iteration, <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14977","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}