In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme: zero the discard fallback page<\/p>\n
nvme_setup_discard() always maps sizeof(struct nvme_dsm_range) *
\nNVME_DSM_MAX_RANGES = 4096 bytes as the DSM payload however many ranges
\nthe command declares, because some devices ignore the ‘Number of Ranges’
\nfield – the Fixes: commit records two that read past the declared ranges.
\nA single-range discard fills only the first 16 bytes.<\/p>\n
Normally the buffer comes from kzalloc() and the other 4080 bytes are
\nzero. When that allocation fails the code falls back to the
\nper-controller ctrl->discard_page, which nvme_init_ctrl() obtains with
\nalloc_page(GFP_KERNEL) and nothing ever zeroes, so those 4080 bytes are
\nwhatever the page last held and are handed to the controller. Reaching
\nit requires the kzalloc(GFP_ATOMIC | __GFP_NOWARN) to fail, that is
\nmemory pressure; it is not remotely triggerable. Failing the allocation
\nunder KMSAN reproduces it, with the leaked tail full of vmemmap struct
\npage pointers. The extent in the report is a partial transfer of the
\npayload, not the whole 4096 bytes; the 16-byte boundary in it is the one
\ndeclared range:<\/p>\n
[ 11.991601] BUG: KMSAN: uninit-value in dma_map_phys+0x14c8\/0x1900
\n[ 11.991969] dma_map_phys+0x14c8\/0x1900
\n[ 11.992220] dma_map_page_attrs+0xcf\/0x130
\n[ 11.992485] e1000_xmit_frame+0x4099\/0x6d10
\n[ 11.992768] dev_hard_start_xmit+0x22f\/0xa80
\n[ 11.993068] sch_direct_xmit+0x35c\/0xcb0
\n[ 11.993315] __dev_queue_xmit+0x1ee5\/0x5eb0
\n[ 11.993608] ip_finish_output2+0x1903\/0x1c30
\n[ 11.993881] ip_finish_output+0x288\/0x870
\n[ 11.994125] ip_output+0x15e\/0x400
\n[ 11.994365] __ip_queue_xmit+0x1e85\/0x1fb0
\n[ 11.994639] ip_queue_xmit+0x60\/0x80
\n[ 11.994899] __tcp_transmit_skb+0x4e71\/0x5fa0
\n[ 11.995210] tcp_write_xmit+0x3a36\/0x9160
\n[ 11.995533] __tcp_push_pending_frames+0xc5\/0x3c0
\n[ 11.995854] tcp_push+0x7dc\/0x840
\n[ 11.996076] tcp_sendmsg_locked+0x766c\/0x8400
\n[ 11.996371] tcp_sendmsg+0x4b\/0x90
\n[ 11.996572] inet_sendmsg+0x134\/0x2a0
\n[ 11.996823] __sock_sendmsg+0x265\/0x360
\n[ 11.997076] sock_sendmsg+0x100\/0x1e0
\n[ 11.997293] nvme_tcp_try_send+0x196f\/0x6370
\n[ 11.997605] nvme_tcp_queue_rq+0x1d54\/0x20b0
\n[ 11.997882] blk_mq_dispatch_rq_list+0x5ee\/0x2e50
\n[ 11.998175] __blk_mq_sched_dispatch_requests+0x16dc\/0x24a0
\n[ 11.998539] blk_mq_sched_dispatch_requests+0x11b\/0x2c0
\n[ 11.998865] blk_mq_run_work_fn+0x13b\/0x280
\n[ 11.999146] process_scheduled_works+0x966\/0x1ad0
\n[ 11.999465] worker_thread+0xe44\/0x1480
\n[ 11.999709] kthread+0x53b\/0x600
\n[ 11.999927] ret_from_fork+0x29f\/0x7c0
\n[ 12.000191] ret_from_fork_asm+0x1a\/0x30
\n[ 12.000460]
\n[ 12.000558] Uninit was created at:
\n[ 12.000788] __alloc_frozen_pages_noprof+0x8bf\/0xd30
\n[ 12.001096] alloc_pages_mpol+0x1d0\/0x5f0
\n[ 12.001326] alloc_pages_noprof+0x102\/0x290
\n[ 12.001627] nvme_init_ctrl+0x5a3\/0x9f0
\n[ 12.001891] nvme_tcp_create_ctrl+0xd75\/0x19b0
\n[ 12.002170] nvmf_dev_write+0x4c68\/0x4fd0
\n[ 12.002426] vfs_write+0x587\/0x1a10
\n[ 12.002636] __x64_sys_write+0x207\/0x4f0
\n[ 12.002874] x64_sys_call+0x2ff0\/0x3ea0
\n[ 12.003123] do_syscall_64+0x147\/0x3b0
\n[ 12.003400] entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\n[ 12.003680]
\n[ 12.003777] Bytes 16-2843 of 2844 are uninitialized
\n[ 12.004068] Memory access of size 2844 starts at ffff888109f82000
\n[ 12.004412]
\n[ 12.004530] CPU: 0 UID: 0 PID: 101 Comm: kworker\/0:1H Not tainted 7.2.0-rc5-NVMECTL-gf5098b6bae76 #1 PREEMPT(lazy)
\n[ 12.005127] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\n[ 12.005762] Workqueue: kblockd blk_mq_run_work_fn
\n[ 12.006073] =====================================================<\/p>\n
Allocate the page with __GFP_ZERO. The single allocation site covers
\nevery use of it: bytes no discard has written stay zero, and bytes one
\ndid write hold that controller’s own range list, which it has already
\nbeen sent.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme: zero the discard fallback page<\/p>\n
nvme_setup_discard() always maps sizeof(struct nvme_dsm_range) *
\nNVME_DSM_MAX_RANGES = 4096 b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21405","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21405","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21405"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21405"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21405"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}