cve-2024-26759
Vulnerability from cvelistv5
Published
2024-04-03 17:00
Modified
2024-08-02 00:14
Severity
Summary
mm/swap: fix race when skipping swapcache
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-08T14:03:53.009974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:35.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.279Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/swap.h",
            "mm/memory.c",
            "mm/swap.h",
            "mm/swapfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2dedda77d449",
              "status": "affected",
              "version": "0bcac06f27d7",
              "versionType": "git"
            },
            {
              "lessThan": "305152314df8",
              "status": "affected",
              "version": "0bcac06f27d7",
              "versionType": "git"
            },
            {
              "lessThan": "d183a4631acf",
              "status": "affected",
              "version": "0bcac06f27d7",
              "versionType": "git"
            },
            {
              "lessThan": "13ddaf26be32",
              "status": "affected",
              "version": "0bcac06f27d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/swap.h",
            "mm/memory.c",
            "mm/swap.h",
            "mm/swapfile.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swap: fix race when skipping swapcache\n\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\nswapin the same entry at the same time, they get different pages (A, B). \nBefore one thread (T0) finishes the swapin and installs page (A) to the\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\nentry, then swap out the possibly modified page reusing the same entry. \nIt breaks the pte_same check in (T0) because PTE value is unchanged,\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\nPTE and cause data corruption.\n\nOne possible callstack is like this:\n\nCPU0                                 CPU1\n----                                 ----\ndo_swap_page()                       do_swap_page() with same entry\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\n\u003calloc page A\u003e                       \u003calloc page B\u003e\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\n...                                  set_pte_at()\n                                     swap_free() \u003c- entry is free\n                                     \u003cwrite to page B, now page A stalled\u003e\n                                     \u003cswap out page B to same swap entry\u003e\npte_same() \u003c- Check pass, PTE seems\n              unchanged, but page A\n              is stalled!\nswap_free() \u003c- page B content lost!\nset_pte_at() \u003c- staled page A installed!\n\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\nentry content, so even if page (B) is not modified, if swap_read_folio()\non CPU0 happens later than swap_free() on CPU1, it may also cause data\nloss.\n\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\nthe cache flag, and allow only one thread to swap it in, also prevent any\nparallel code from putting the entry in the cache.  Release the pin after\nPT unlocked.\n\nRacers just loop and wait since it\u0027s a rare and very short event.  A\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\nfaults wasting too much CPU, causing livelock or adding too much noise to\nperf statistics.  A similar livelock issue was described in commit\n029c4628b2eb (\"mm: swap: get rid of livelock in swapin readahead\")\n\nReproducer:\n\nThis race issue can be triggered easily using a well constructed\nreproducer and patched brd (with a delay in read path) [1]:\n\nWith latest 6.8 mainline, race caused data loss can be observed easily:\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\n  Polulating 32MB of memory region...\n  Keep swapping out...\n  Starting round 0...\n  Spawning 65536 workers...\n  32746 workers spawned, wait for done...\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\n  Round 0 Failed, 15 data loss!\n\nThis reproducer spawns multiple threads sharing the same memory region\nusing a small swap device.  Every two threads updates mapped pages one by\none in opposite direction trying to create a race, with one dedicated\nthread keep swapping out the data out using madvise.\n\nThe reproducer created a reproduce rate of about once every 5 minutes, so\nthe race should be totally possible in production.\n\nAfter this patch, I ran the reproducer for over a few hundred rounds and\nno data loss observed.\n\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\nzram:\n\nBefore:     10934698 us\nAfter:      11157121 us\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\n\n[kasong@tencent.com: v4]\n  Link: https://lkml.kernel.org/r/20240219082040.7495-1-ryncsn@gmail.com"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:22:13.899Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95"
        },
        {
          "url": "https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d"
        },
        {
          "url": "https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458"
        }
      ],
      "title": "mm/swap: fix race when skipping swapcache",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26759",
    "datePublished": "2024-04-03T17:00:43.288Z",
    "dateReserved": "2024-02-19T14:20:24.170Z",
    "dateUpdated": "2024-08-02T00:14:13.279Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26759\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:52.320\",\"lastModified\":\"2024-04-03T17:24:18.150\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/swap: fix race when skipping swapcache\\n\\nWhen skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads\\nswapin the same entry at the same time, they get different pages (A, B). \\nBefore one thread (T0) finishes the swapin and installs page (A) to the\\nPTE, another thread (T1) could finish swapin of page (B), swap_free the\\nentry, then swap out the possibly modified page reusing the same entry. \\nIt breaks the pte_same check in (T0) because PTE value is unchanged,\\ncausing ABA problem.  Thread (T0) will install a stalled page (A) into the\\nPTE and cause data corruption.\\n\\nOne possible callstack is like this:\\n\\nCPU0                                 CPU1\\n----                                 ----\\ndo_swap_page()                       do_swap_page() with same entry\\n\u003cdirect swapin path\u003e                 \u003cdirect swapin path\u003e\\n\u003calloc page A\u003e                       \u003calloc page B\u003e\\nswap_read_folio() \u003c- read to page A  swap_read_folio() \u003c- read to page B\\n\u003cslow on later locks or interrupt\u003e   \u003cfinished swapin first\u003e\\n...                                  set_pte_at()\\n                                     swap_free() \u003c- entry is free\\n                                     \u003cwrite to page B, now page A stalled\u003e\\n                                     \u003cswap out page B to same swap entry\u003e\\npte_same() \u003c- Check pass, PTE seems\\n              unchanged, but page A\\n              is stalled!\\nswap_free() \u003c- page B content lost!\\nset_pte_at() \u003c- staled page A installed!\\n\\nAnd besides, for ZRAM, swap_free() allows the swap device to discard the\\nentry content, so even if page (B) is not modified, if swap_read_folio()\\non CPU0 happens later than swap_free() on CPU1, it may also cause data\\nloss.\\n\\nTo fix this, reuse swapcache_prepare which will pin the swap entry using\\nthe cache flag, and allow only one thread to swap it in, also prevent any\\nparallel code from putting the entry in the cache.  Release the pin after\\nPT unlocked.\\n\\nRacers just loop and wait since it\u0027s a rare and very short event.  A\\nschedule_timeout_uninterruptible(1) call is added to avoid repeated page\\nfaults wasting too much CPU, causing livelock or adding too much noise to\\nperf statistics.  A similar livelock issue was described in commit\\n029c4628b2eb (\\\"mm: swap: get rid of livelock in swapin readahead\\\")\\n\\nReproducer:\\n\\nThis race issue can be triggered easily using a well constructed\\nreproducer and patched brd (with a delay in read path) [1]:\\n\\nWith latest 6.8 mainline, race caused data loss can be observed easily:\\n$ gcc -g -lpthread test-thread-swap-race.c \u0026\u0026 ./a.out\\n  Polulating 32MB of memory region...\\n  Keep swapping out...\\n  Starting round 0...\\n  Spawning 65536 workers...\\n  32746 workers spawned, wait for done...\\n  Round 0: Error on 0x5aa00, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x395200, expected 32746, got 32743, 3 data loss!\\n  Round 0: Error on 0x3fd000, expected 32746, got 32737, 9 data loss!\\n  Round 0 Failed, 15 data loss!\\n\\nThis reproducer spawns multiple threads sharing the same memory region\\nusing a small swap device.  Every two threads updates mapped pages one by\\none in opposite direction trying to create a race, with one dedicated\\nthread keep swapping out the data out using madvise.\\n\\nThe reproducer created a reproduce rate of about once every 5 minutes, so\\nthe race should be totally possible in production.\\n\\nAfter this patch, I ran the reproducer for over a few hundred rounds and\\nno data loss observed.\\n\\nPerformance overhead is minimal, microbenchmark swapin 10G from 32G\\nzram:\\n\\nBefore:     10934698 us\\nAfter:      11157121 us\\nCached:     13155355 us (Dropping SWP_SYNCHRONOUS_IO flag)\\n\\n[kasong@tencent.com: v4]\\n  Link: https://lkml.kernel.org/r/20240219082040.7495-1-ryncsn@gmail.com\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/swap: corrige la ejecuci\u00f3n al omitir swapcache Al omitir swapcache para SWP_SYNCHRONOUS_IO, si dos o m\u00e1s subprocesos intercambian la misma entrada al mismo tiempo, obtienen p\u00e1ginas diferentes (A, B) . Antes de que un subproceso (T0) finalice el intercambio e instale la p\u00e1gina (A) en el PTE, otro subproceso (T1) podr\u00eda finalizar el intercambio de la p\u00e1gina (B), liberar la entrada y luego intercambiar la p\u00e1gina posiblemente modificada reutilizando la misma entrada. Rompe el control pte_same (T0) porque el valor de PTE no cambia, lo que provoca un problema de ABA. El subproceso (T0) instalar\u00e1 una p\u00e1gina bloqueada (A) en el PTE y provocar\u00e1 da\u00f1os en los datos. Una posible pila de llamadas es as\u00ed: CPU0 CPU1 ---- ---- do_swap_page() do_swap_page() con la misma entrada     swap_read_folio() \u0026lt; - leer en la p\u00e1gina A swap_read_folio() \u0026lt;- leer en la p\u00e1gina B   ... set_pte_at() swap_free() \u0026lt;- la entrada es libre   pte_same() \u0026lt;- Verificar pase, PTE parece no haber cambiado, \u00a1pero la p\u00e1gina A est\u00e1 estancada! swap_free() \u0026lt;- \u00a1Contenido de la p\u00e1gina B perdido! set_pte_at() \u0026lt;- \u00a1p\u00e1gina A obsoleta instalada! Y adem\u00e1s, para ZRAM, swap_free() permite que el dispositivo de intercambio descarte el contenido de la entrada, por lo que incluso si la p\u00e1gina (B) no se modifica, si swap_read_folio() en CPU0 ocurre m\u00e1s tarde que swap_free() en CPU1, tambi\u00e9n puede causar que los datos p\u00e9rdida. Para solucionar este problema, reutilice swapcache_prepare, que fijar\u00e1 la entrada de intercambio usando el indicador de cach\u00e9 y permitir\u00e1 que solo un hilo la intercambie, y tambi\u00e9n evitar\u00e1 que cualquier c\u00f3digo paralelo coloque la entrada en el cach\u00e9. Suelte el pasador despu\u00e9s de desbloquear el PT. Los corredores simplemente dan vueltas y esperan, ya que es un evento raro y muy corto. Se agrega una llamada Schedule_timeout_uninterruptible(1) para evitar errores repetidos de p\u00e1gina que desperdician demasiada CPU, provocando bloqueos en vivo o agregando demasiado ruido a las estad\u00edsticas de rendimiento. Un problema similar de livelock se describi\u00f3 en el compromiso 029c4628b2eb (\\\"mm: swap: deshacerse de livelock en swapin readahead\\\") Reproductor: este problema de ejecuci\u00f3n se puede activar f\u00e1cilmente utilizando un reproductor bien construido y un brd parcheado (con un retraso en la ruta de lectura) [ 1]: Con la \u00faltima l\u00ednea principal 6.8, la p\u00e9rdida de datos causada por la ejecuci\u00f3n se puede observar f\u00e1cilmente: $ gcc -g -lpthread test-thread-swap-race.c \u0026amp;\u0026amp; ./a.out Contaminando 32 MB de regi\u00f3n de memoria... Siga intercambiando. .. Comenzando la ronda 0... Generando 65536 trabajadores... Se generaron 32746 trabajadores, espere a que termine... Ronda 0: Error en 0x5aa00, se esperaban 32746, obtuve 32743, \u00a13 p\u00e9rdida de datos! Ronda 0: Error en 0x395200, se esperaba 32746, obtuve 32743, \u00a13 p\u00e9rdida de datos! Ronda 0: Error en 0x3fd000, esperado 32746, obtuve 32737, \u00a19 p\u00e9rdida de datos! Ronda 0 fallida, \u00a115 p\u00e9rdida de datos! Este reproductor genera m\u00faltiples subprocesos que comparten la misma regi\u00f3n de memoria mediante un peque\u00f1o dispositivo de intercambio. Cada dos subprocesos actualiza las p\u00e1ginas asignadas una por una en direcci\u00f3n opuesta tratando de crear una ejecuci\u00f3n, con un subproceso dedicado sigue intercambiando los datos usando madvise. El reproductor cre\u00f3 una tasa de reproducci\u00f3n de aproximadamente una vez cada 5 minutos, por lo que la ejecuci\u00f3n deber\u00eda ser totalmente posible en producci\u00f3n. Despu\u00e9s de este parche, ejecut\u00e9 el reproductor durante m\u00e1s de unos cientos de rondas y no se observ\u00f3 p\u00e9rdida de datos. ---truncado---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13ddaf26be324a7f951891ecd9ccd04466d27458\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2dedda77d4493f3e92e414b272bfa60f1f51ed95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/305152314df82b22cf9b181f3dc5fc411002079a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d183a4631acfc7af955c02a02e739cec15f5234d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.