In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm: Fix user-space data loss with MADV_FREE and THP<\/p>\n
Some of users of Polars (a data analytics library) have lost production
\ndata from this bug. They seem to have just the right combination of
\nhuge pages, MADV_FREE and heavy reclaim pressure.<\/p>\n
pmd_modify() masks the old value with (_HPAGE_CHG_MASK & ~_PAGE_DIRTY),
\nsilently discarding the hardware dirty bit. The subsequent
\npmd_mksaveddirty() call is supposed to transfer _PAGE_DIRTY into
\n_PAGE_SAVED_DIRTY when write-protecting, but the dirty bit was already
\nstripped from the value, so there is nothing left to transfer.<\/p>\n
Contrast with pte_modify(), which keeps _PAGE_DIRTY_BITS in its mask,
\nand pud_modify(), which keeps _HPAGE_CHG_MASK untouched: pmd_modify()
\nis the odd one out. Any pmd_modify() on a writable, dirty PMD loses
\nthe dirty state.<\/p>\n
One visible consequence is data loss with MADV_FREE on PMD-mapped THP:<\/p>\n
memset(buf, 0x5A, size); \/\/ PMD-mapped THP, PMD dirty
\n madvise(buf, size, MADV_FREE); \/\/ PMD cleaned but left writable,
\n \/\/ folio marked lazyfree
\n memset(buf, 0x5A, size); \/\/ hardware sets _PAGE_DIRTY again
\n mprotect(buf, size, PROT_READ); \/\/ pmd_modify() drops the dirty bit
\n mprotect(buf, size, PROT_READ|PROT_WRITE);
\n \/\/ … memory pressure …<\/p>\n
Reclaim (e.g. under memcg pressure) then finds the lazyfree folio with
\nno dirty bit set anywhere and frees it in
\n__discard_anon_folio_pmd_locked(), even though the data was rewritten
\nafter MADV_FREE; subsequent reads fault in fresh zero pages. NUMA
\nhinting alone can trigger the same loss, as do_huge_pmd_numa_page()
\nrestores the PMD through pmd_modify() as well.<\/p>\n
PMD-mapped file THPs are affected too: mprotect()\/NUMA hinting dropping
\nthe dirty bit means rewritten data is never written back.<\/p>\n
Fix it by keeping _PAGE_DIRTY in the preserved mask, exactly like
\npte_modify() and pud_modify() do. The existing
\npmd_mksaveddirty()\/pmd_clear_saveddirty() pair then performs the
\nhardware-dirty saved-dirty transition based on the write bit,
\npreserving the shadow-stack encoding rules.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm: Fix user-space data loss with MADV_FREE and THP<\/p>\n
Some of users of Polars (a data analytics library) have lost production
\nda<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29101","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}