In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm\/pat: Take cpa_lock around large-page collapse<\/p>\n
Loading and unloading modules concurrently on several CPUs on a KASAN
\nbuild, with a short delay injected at the CPA page-table lookup to
\nwiden the window, faults within minutes:<\/p>\n
BUG: KASAN: use-after-free in __change_page_attr+0x7cc\/0x7e0
\n Write of size 8 at addr ffff888181139718 by task modprobe
\n …
\n The buggy address belongs to the physical page:
\n pfn:0x181139 … page_type: f2(table)<\/p>\n
cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and
\nfrees the old PTE-table pages, while __change_page_attr() fetches a
\nPTE pointer from a lockless lookup_address_in_pgd_attr() and writes
\nit with set_pte_atomic() only later. When module text is served from
\na shared large ROX mapping the two run on the same PMD:<\/p>\n
CPU A (module load) CPU B (module finalize)
\n ——————- ———————–
\n execmem_make_temp_rw
\n set_memory_nx
\n __change_page_attr
\n split 2M -> 4K table P
\n kpte = &P[i] (lockless)
\n execmem_restore_rox
\n set_memory_rox (CPA_COLLAPSE)
\n cpa_collapse_large_pages
\n rebuild leaf PMD
\n flush_tlb_all
\n pagetable_free(P)
\n set_pte_atomic(kpte, …)
\n -> writes into freed P<\/p>\n
P is a page-table page (page_type: table), reused at once, so the
\nwrite corrupts whatever got the page next: a bad-pte or bad-page
\nsplat, or a fatal fault once P has been turned into read-only text.<\/p>\n
The flush_tlb_all() before the free does not close this: its IPI only
\nserializes against page-table walkers that run with interrupts off
\n(e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts
\non, so nothing stops it from holding a stale pointer into P.<\/p>\n
Serialize the collapse – the PMD rebuild, TLB flush and PTE-table
\nfree – under cpa_lock, the same lock __change_page_attr() now takes
\nunconditionally since commit (“x86\/mm\/pat: stop gating cpa_lock on
\ndebug_pagealloc_enabled()”), so a concurrent walker can no longer
\nhold a pointer into a table the collapse is about to free.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm\/pat: Take cpa_lock around large-page collapse<\/p>\n
Loading and unloading modules concurrently on several CPUs on a KASAN
\nbuild, <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25925","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}