In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()<\/p>\n
When hardware page table walker (PTW) is enabled on LoongArch, the CPU
\nmay set _PAGE_DIRTY directly in the page table entry during a write TLB
\nmiss, without going through the software TLB store handler. The software
\nTLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED
\ntogether:<\/p>\n
ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)<\/p>\n
Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e.
\n_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has
\n_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED
\nclear (software is unaware).<\/p>\n
When fork()\/clone() triggers copy-on-write, __copy_present_ptes() calls
\npte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and
\n_PAGE_DIRTY bits:<\/p>\n
pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);<\/p>\n
Since _PAGE_MODIFIED was never set, the dirtiness information is lost
\ncompletely. Subsequently, when memory pressure triggers page reclaim,
\npage_mkclean() \/ try_to_unmap() sees the page as clean (i.e. pte_dirty()
\nreturns false) and the page may be freed without writeback, causing data
\ncorruption.<\/p>\n
Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in
\nboth pte_wrprotect() and pmd_wrprotect() before clearing writeable bits:<\/p>\n
if (pte_val(pte) & _PAGE_DIRTY)
\n pte_val(pte) |= _PAGE_MODIFIED;<\/p>\n
The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case,
\nwhere pmd entries need the same treatment.<\/p>\n
This ensures the software dirty tracking bit (checked by pte_dirty() and
\npmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is
\npreserved across fork COW write-protection.<\/p>\n
The issue was found by the LTP madvise09 test case, which exercises page
\nreclaim after “madvise(MADV_FREE), write and fork” operation sequence on
\nprivate anonymous mappings.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()<\/p>\n
When hardware page table walker (PTW) is enabled on LoongArch,<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6743","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}