In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm\/pat: Allocate split page tables as kernel page tables<\/p>\n
A PTE is allocated directly without going through the standard page table
\nallocation routines (such as pte_alloc_one_kernel()) when the CPA code
\nsplits a large page (__split_large_page()).<\/p>\n
This means the page table constructor is never called nor is the page table
\nmarked as a kernel page table.<\/p>\n
The former results in the folio associated with the page table not being
\nmarked as a page table (__pagetable_ctor() is never called thus neither is
\n__folio_set_pgtable()) nor are statistics updated to reflect
\nit (lruvec_stat_add_folio() is never called).<\/p>\n
The latter issue of failing to mark the page table as a kernel page
\ntable (ptdesc_set_kernel() is never called) is far more problematic.<\/p>\n
Since commit:<\/p>\n
5ba2f0a15564 (“mm: introduce deferred freeing for kernel page tables”)<\/p>\n
kernel page table freeing has been batched and since the
\nsubsequent commit:<\/p>\n
e37d5a2d60a3 (“iommu\/sva: invalidate stale IOTLB entries for kernel address space”)<\/p>\n
IOTLB cache entries for kernel page tables have been invalidated upon
\nbeing freed.<\/p>\n
Since split page tables are freed without this invalidation, the IOTLB
\ncan contain stale entries for them.<\/p>\n
Resolve the issue by using the ordinary PTE allocation API at split time.<\/p>\n
This results in these kernel page tables invoking a page table constructor,
\nand thus requires a page table destructor.<\/p>\n
Destructors are not always present, like for early allocated direct map
\npage tables). Conditionally call pagetable_dtor_free() if the PG_table
\nfolio flag for the ptdesc is set, otherwise we free the page table via
\npagetable_free().<\/p>\n
Regardless of which path is taken page tables marked as kernel page tables,
\nwhich now includes split page tables, take the correct route through
\npagetable_free_kernel().<\/p>\n
There is a user-visible side effect in that split page tables will appear
\nin nr_page_table_pages in \/proc\/vmstat (as do other kernel page tables
\nallocated after early boot), however this is a positive change.<\/p>\n
This issue started being markedly problematic after commit:<\/p>\n
5ba2f0a15564 (“mm: introduce deferred freeing for kernel page tables”)<\/p>\n
so choose this as the Fixes target.<\/p>\n
[ dhansen: rephrase in imperative mood ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm\/pat: Allocate split page tables as kernel page tables<\/p>\n
A PTE is allocated directly without going through the standard page t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28957","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}