cve-2024-42243
Vulnerability from cvelistv5
Published
2024-08-07 15:14
Modified
2024-12-19 09:14
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Patch series "mm/filemap: Limit page cache size to that supported by xarray", v2. Currently, xarray can't support arbitrary page cache size. More details can be found from the WARN_ON() statement in xas_split_alloc(). In our test whose code is attached below, we hit the WARN_ON() on ARM64 system where the base page size is 64KB and huge page size is 512MB. The issue was reported long time ago and some discussions on it can be found here [1]. [1] https://www.spinics.net/lists/linux-xfs/msg75404.html In order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one supported by xarray and avoid PMD-sized page cache if needed. The code changes are suggested by David Hildenbrand. PATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray PATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path PATCH[4] avoids PMD-sized page cache for shmem files if needed Test program ============ # cat test.c #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <string.h> #include <fcntl.h> #include <errno.h> #include <sys/syscall.h> #include <sys/mman.h> #define TEST_XFS_FILENAME "/tmp/data" #define TEST_SHMEM_FILENAME "/dev/shm/data" #define TEST_MEM_SIZE 0x20000000 int main(int argc, char **argv) { const char *filename; int fd = 0; void *buf = (void *)-1, *p; int pgsize = getpagesize(); int ret; if (pgsize != 0x10000) { fprintf(stderr, "64KB base page size is required\n"); return -EPERM; } system("echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled"); system("rm -fr /tmp/data"); system("rm -fr /dev/shm/data"); system("echo 1 > /proc/sys/vm/drop_caches"); /* Open xfs or shmem file */ filename = TEST_XFS_FILENAME; if (argc > 1 && !strcmp(argv[1], "shmem")) filename = TEST_SHMEM_FILENAME; fd = open(filename, O_CREAT | O_RDWR | O_TRUNC); if (fd < 0) { fprintf(stderr, "Unable to open <%s>\n", filename); return -EIO; } /* Extend file size */ ret = ftruncate(fd, TEST_MEM_SIZE); if (ret) { fprintf(stderr, "Error %d to ftruncate()\n", ret); goto cleanup; } /* Create VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (buf == (void *)-1) { fprintf(stderr, "Unable to mmap <%s>\n", filename); goto cleanup; } fprintf(stdout, "mapped buffer at 0x%p\n", buf); ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); if (ret) { fprintf(stderr, "Unable to madvise(MADV_HUGEPAGE)\n"); goto cleanup; } /* Populate VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE); if (ret) { fprintf(stderr, "Error %d to madvise(MADV_POPULATE_WRITE)\n", ret); goto cleanup; } /* Punch the file to enforce xarray split */ ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); if (ret) fprintf(stderr, "Error %d to fallocate()\n", ret); cleanup: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); if (fd > 0) close(fd); return 0; } # gcc test.c -o test # cat /proc/1/smaps | grep KernelPageSize | head -n 1 KernelPageSize: 64 kB # ./test shmem : ------------[ cut here ]------------ WARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \ nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \ ip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon \ drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 \ virtio_net sha1_ce net_failover failover virtio_console virtio_blk \ dimlib virtio_mmio CPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024 pstate: 83400005 (Nzcv daif +PAN -UAO +TC ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/099d90642a711caae377f53309abfe27e8724a8bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/333c5539a31f48828456aa9997ec2808f06a699aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a0c42ddd0969fdc760a85e20e267776028a7ca4ePatch
Impacted products
Vendor Product Version
Linux Linux Version: 5.18
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42243",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:13:41.421528Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:31.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/pagemap.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0c42ddd0969fdc760a85e20e267776028a7ca4e",
              "status": "affected",
              "version": "793917d997df2e432f3e9ac126e4482d68256d01",
              "versionType": "git"
            },
            {
              "lessThan": "333c5539a31f48828456aa9997ec2808f06a699a",
              "status": "affected",
              "version": "793917d997df2e432f3e9ac126e4482d68256d01",
              "versionType": "git"
            },
            {
              "lessThan": "099d90642a711caae377f53309abfe27e8724a8b",
              "status": "affected",
              "version": "793917d997df2e432f3e9ac126e4482d68256d01",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/pagemap.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray\n\nPatch series \"mm/filemap: Limit page cache size to that supported by\nxarray\", v2.\n\nCurrently, xarray can\u0027t support arbitrary page cache size.  More details\ncan be found from the WARN_ON() statement in xas_split_alloc().  In our\ntest whose code is attached below, we hit the WARN_ON() on ARM64 system\nwhere the base page size is 64KB and huge page size is 512MB.  The issue\nwas reported long time ago and some discussions on it can be found here\n[1].\n\n[1] https://www.spinics.net/lists/linux-xfs/msg75404.html\n\nIn order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one\nsupported by xarray and avoid PMD-sized page cache if needed.  The code\nchanges are suggested by David Hildenbrand.\n\nPATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray\nPATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path\nPATCH[4] avoids PMD-sized page cache for shmem files if needed\n\nTest program\n============\n# cat test.c\n#define _GNU_SOURCE\n#include \u003cstdio.h\u003e\n#include \u003cstdlib.h\u003e\n#include \u003cunistd.h\u003e\n#include \u003cstring.h\u003e\n#include \u003cfcntl.h\u003e\n#include \u003cerrno.h\u003e\n#include \u003csys/syscall.h\u003e\n#include \u003csys/mman.h\u003e\n\n#define TEST_XFS_FILENAME\t\"/tmp/data\"\n#define TEST_SHMEM_FILENAME\t\"/dev/shm/data\"\n#define TEST_MEM_SIZE\t\t0x20000000\n\nint main(int argc, char **argv)\n{\n\tconst char *filename;\n\tint fd = 0;\n\tvoid *buf = (void *)-1, *p;\n\tint pgsize = getpagesize();\n\tint ret;\n\n\tif (pgsize != 0x10000) {\n\t\tfprintf(stderr, \"64KB base page size is required\\n\");\n\t\treturn -EPERM;\n\t}\n\n\tsystem(\"echo force \u003e /sys/kernel/mm/transparent_hugepage/shmem_enabled\");\n\tsystem(\"rm -fr /tmp/data\");\n\tsystem(\"rm -fr /dev/shm/data\");\n\tsystem(\"echo 1 \u003e /proc/sys/vm/drop_caches\");\n\n\t/* Open xfs or shmem file */\n\tfilename = TEST_XFS_FILENAME;\n\tif (argc \u003e 1 \u0026\u0026 !strcmp(argv[1], \"shmem\"))\n\t\tfilename = TEST_SHMEM_FILENAME;\n\n\tfd = open(filename, O_CREAT | O_RDWR | O_TRUNC);\n\tif (fd \u003c 0) {\n\t\tfprintf(stderr, \"Unable to open \u003c%s\u003e\\n\", filename);\n\t\treturn -EIO;\n\t}\n\n\t/* Extend file size */\n\tret = ftruncate(fd, TEST_MEM_SIZE);\n\tif (ret) {\n\t\tfprintf(stderr, \"Error %d to ftruncate()\\n\", ret);\n\t\tgoto cleanup;\n\t}\n\n\t/* Create VMA */\n\tbuf = mmap(NULL, TEST_MEM_SIZE,\n\t\t   PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);\n\tif (buf == (void *)-1) {\n\t\tfprintf(stderr, \"Unable to mmap \u003c%s\u003e\\n\", filename);\n\t\tgoto cleanup;\n\t}\n\n\tfprintf(stdout, \"mapped buffer at 0x%p\\n\", buf);\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);\n        if (ret) {\n\t\tfprintf(stderr, \"Unable to madvise(MADV_HUGEPAGE)\\n\");\n\t\tgoto cleanup;\n\t}\n\n\t/* Populate VMA */\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE);\n\tif (ret) {\n\t\tfprintf(stderr, \"Error %d to madvise(MADV_POPULATE_WRITE)\\n\", ret);\n\t\tgoto cleanup;\n\t}\n\n\t/* Punch the file to enforce xarray split */\n\tret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,\n        \t\tTEST_MEM_SIZE - pgsize, pgsize);\n\tif (ret)\n\t\tfprintf(stderr, \"Error %d to fallocate()\\n\", ret);\n\ncleanup:\n\tif (buf != (void *)-1)\n\t\tmunmap(buf, TEST_MEM_SIZE);\n\tif (fd \u003e 0)\n\t\tclose(fd);\n\n\treturn 0;\n}\n\n# gcc test.c -o test\n# cat /proc/1/smaps | grep KernelPageSize | head -n 1\nKernelPageSize:       64 kB\n# ./test shmem\n   :\n------------[ cut here ]------------\nWARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128\nModules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib  \\\nnft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct    \\\nnft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4    \\\nip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon          \\\ndrm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64  \\\nvirtio_net sha1_ce net_failover failover virtio_console virtio_blk \\\ndimlib virtio_mmio\nCPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12\nHardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024\npstate: 83400005 (Nzcv daif +PAN -UAO +TC\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:14:43.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a0c42ddd0969fdc760a85e20e267776028a7ca4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/333c5539a31f48828456aa9997ec2808f06a699a"
        },
        {
          "url": "https://git.kernel.org/stable/c/099d90642a711caae377f53309abfe27e8724a8b"
        }
      ],
      "title": "mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42243",
    "datePublished": "2024-08-07T15:14:29.717Z",
    "dateReserved": "2024-07-30T07:40:12.254Z",
    "dateUpdated": "2024-12-19T09:14:43.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42243\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-07T16:15:47.080\",\"lastModified\":\"2024-08-08T14:53:35.073\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray\\n\\nPatch series \\\"mm/filemap: Limit page cache size to that supported by\\nxarray\\\", v2.\\n\\nCurrently, xarray can\u0027t support arbitrary page cache size.  More details\\ncan be found from the WARN_ON() statement in xas_split_alloc().  In our\\ntest whose code is attached below, we hit the WARN_ON() on ARM64 system\\nwhere the base page size is 64KB and huge page size is 512MB.  The issue\\nwas reported long time ago and some discussions on it can be found here\\n[1].\\n\\n[1] https://www.spinics.net/lists/linux-xfs/msg75404.html\\n\\nIn order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one\\nsupported by xarray and avoid PMD-sized page cache if needed.  The code\\nchanges are suggested by David Hildenbrand.\\n\\nPATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray\\nPATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path\\nPATCH[4] avoids PMD-sized page cache for shmem files if needed\\n\\nTest program\\n============\\n# cat test.c\\n#define _GNU_SOURCE\\n#include \u003cstdio.h\u003e\\n#include \u003cstdlib.h\u003e\\n#include \u003cunistd.h\u003e\\n#include \u003cstring.h\u003e\\n#include \u003cfcntl.h\u003e\\n#include \u003cerrno.h\u003e\\n#include \u003csys/syscall.h\u003e\\n#include \u003csys/mman.h\u003e\\n\\n#define TEST_XFS_FILENAME\\t\\\"/tmp/data\\\"\\n#define TEST_SHMEM_FILENAME\\t\\\"/dev/shm/data\\\"\\n#define TEST_MEM_SIZE\\t\\t0x20000000\\n\\nint main(int argc, char **argv)\\n{\\n\\tconst char *filename;\\n\\tint fd = 0;\\n\\tvoid *buf = (void *)-1, *p;\\n\\tint pgsize = getpagesize();\\n\\tint ret;\\n\\n\\tif (pgsize != 0x10000) {\\n\\t\\tfprintf(stderr, \\\"64KB base page size is required\\\\n\\\");\\n\\t\\treturn -EPERM;\\n\\t}\\n\\n\\tsystem(\\\"echo force \u003e /sys/kernel/mm/transparent_hugepage/shmem_enabled\\\");\\n\\tsystem(\\\"rm -fr /tmp/data\\\");\\n\\tsystem(\\\"rm -fr /dev/shm/data\\\");\\n\\tsystem(\\\"echo 1 \u003e /proc/sys/vm/drop_caches\\\");\\n\\n\\t/* Open xfs or shmem file */\\n\\tfilename = TEST_XFS_FILENAME;\\n\\tif (argc \u003e 1 \u0026\u0026 !strcmp(argv[1], \\\"shmem\\\"))\\n\\t\\tfilename = TEST_SHMEM_FILENAME;\\n\\n\\tfd = open(filename, O_CREAT | O_RDWR | O_TRUNC);\\n\\tif (fd \u003c 0) {\\n\\t\\tfprintf(stderr, \\\"Unable to open \u003c%s\u003e\\\\n\\\", filename);\\n\\t\\treturn -EIO;\\n\\t}\\n\\n\\t/* Extend file size */\\n\\tret = ftruncate(fd, TEST_MEM_SIZE);\\n\\tif (ret) {\\n\\t\\tfprintf(stderr, \\\"Error %d to ftruncate()\\\\n\\\", ret);\\n\\t\\tgoto cleanup;\\n\\t}\\n\\n\\t/* Create VMA */\\n\\tbuf = mmap(NULL, TEST_MEM_SIZE,\\n\\t\\t   PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);\\n\\tif (buf == (void *)-1) {\\n\\t\\tfprintf(stderr, \\\"Unable to mmap \u003c%s\u003e\\\\n\\\", filename);\\n\\t\\tgoto cleanup;\\n\\t}\\n\\n\\tfprintf(stdout, \\\"mapped buffer at 0x%p\\\\n\\\", buf);\\n\\tret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);\\n        if (ret) {\\n\\t\\tfprintf(stderr, \\\"Unable to madvise(MADV_HUGEPAGE)\\\\n\\\");\\n\\t\\tgoto cleanup;\\n\\t}\\n\\n\\t/* Populate VMA */\\n\\tret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE);\\n\\tif (ret) {\\n\\t\\tfprintf(stderr, \\\"Error %d to madvise(MADV_POPULATE_WRITE)\\\\n\\\", ret);\\n\\t\\tgoto cleanup;\\n\\t}\\n\\n\\t/* Punch the file to enforce xarray split */\\n\\tret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,\\n        \\t\\tTEST_MEM_SIZE - pgsize, pgsize);\\n\\tif (ret)\\n\\t\\tfprintf(stderr, \\\"Error %d to fallocate()\\\\n\\\", ret);\\n\\ncleanup:\\n\\tif (buf != (void *)-1)\\n\\t\\tmunmap(buf, TEST_MEM_SIZE);\\n\\tif (fd \u003e 0)\\n\\t\\tclose(fd);\\n\\n\\treturn 0;\\n}\\n\\n# gcc test.c -o test\\n# cat /proc/1/smaps | grep KernelPageSize | head -n 1\\nKernelPageSize:       64 kB\\n# ./test shmem\\n   :\\n------------[ cut here ]------------\\nWARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128\\nModules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib  \\\\\\nnft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct    \\\\\\nnft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4    \\\\\\nip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon          \\\\\\ndrm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64  \\\\\\nvirtio_net sha1_ce net_failover failover virtio_console virtio_blk \\\\\\ndimlib virtio_mmio\\nCPU: 17 PID: 5253 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #12\\nHardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024\\npstate: 83400005 (Nzcv daif +PAN -UAO +TC\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/filemap: hacer que MAX_PAGECACHE_ORDER sea aceptable para xarray Serie de parches \\\"mm/filemap: limitar el tama\u00f1o de cach\u00e9 de p\u00e1gina al admitido por xarray\\\", v2. Actualmente, xarray no puede admitir un tama\u00f1o de cach\u00e9 de p\u00e1gina arbitrario. Se pueden encontrar m\u00e1s detalles en la declaraci\u00f3n WARN_ON() en xas_split_alloc(). En nuestra prueba cuyo c\u00f3digo se adjunta a continuaci\u00f3n, presionamos WARN_ON() en el sistema ARM64 donde el tama\u00f1o de p\u00e1gina base es de 64 KB y el tama\u00f1o de p\u00e1gina enorme es de 512 MB. El problema se inform\u00f3 hace mucho tiempo y se pueden encontrar algunas discusiones al respecto aqu\u00ed [1]. [1] https://www.spinics.net/lists/linux-xfs/msg75404.html Para solucionar el problema, debemos ajustar MAX_PAGECACHE_ORDER a uno compatible con xarray y evitar el cach\u00e9 de p\u00e1ginas del tama\u00f1o de PMD si es necesario. Los cambios de c\u00f3digo los sugiere David Hildenbrand. PATCH[1] ajusta MAX_PAGECACHE_ORDER al soportado por xarray PATCH[2-3] evita el cach\u00e9 de p\u00e1ginas de tama\u00f1o PMD en la ruta de lectura anticipada sincr\u00f3nica PATCH[4] evita el cach\u00e9 de p\u00e1ginas de tama\u00f1o PMD para archivos shmem si es necesario Programa de prueba ===== ======= # cat test.c #define _GNU_SOURCE #incluye  #incluye  #incluye  #incluye  #incluye  #include  #include  #include  #define TEST_XFS_FILENAME \\\"/tmp/data\\\" #define TEST_SHMEM_FILENAME \\\"/dev/shm/data\\\" #define TEST_MEM_SIZE 0x20000000 int main(int argc, char **argv) { const char *nombre de archivo; intfd = 0; vac\u00edo *buf = (vac\u00edo *)-1, *p; int pgsize = getpagesize(); ret int; if (pgsize != 0x10000) { fprintf(stderr, \\\"se requiere un tama\u00f1o de p\u00e1gina base de 64 KB\\\\n\\\"); devolver -EPERM; } system(\\\"echo force \u0026gt; /sys/kernel/mm/transparent_hugepage/shmem_enabled\\\"); sistema(\\\"rm -fr /tmp/data\\\"); sistema(\\\"rm -fr /dev/shm/data\\\"); sistema(\\\"echo 1 \u0026gt; /proc/sys/vm/drop_caches\\\"); /* Abrir archivo xfs o shmem */ filename = TEST_XFS_FILENAME; if (argc \u0026gt; 1 \u0026amp;\u0026amp; !strcmp(argv[1], \\\"shmem\\\")) nombre de archivo = TEST_SHMEM_FILENAME; fd = open(nombre de archivo, O_CREAT | O_RDWR | O_TRUNC); if (fd \u0026lt; 0) { fprintf(stderr, \\\"No se puede abrir \u0026lt;%s\u0026gt;\\\\n\\\", nombre de archivo); devolver -EIO; } /* Ampliar tama\u00f1o de archivo */ ret = ftruncate(fd, TEST_MEM_SIZE); if (ret) { fprintf(stderr, \\\"Error %d al ftruncate()\\\\n\\\", ret); ir a limpieza; } /* Crear VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (buf == (void *)-1) { fprintf(stderr, \\\"No se puede mmap \u0026lt;%s\u0026gt;\\\\n\\\", nombre de archivo); ir a limpieza; } fprintf(stdout, \\\"b\u00fafer asignado en 0x%p\\\\n\\\", buf); ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); if (ret) { fprintf(stderr, \\\"No se puede madvise(MADV_HUGEPAGE)\\\\n\\\"); ir a limpieza; } /* Completar VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE); if (ret) { fprintf(stderr, \\\"Error %d en madvise(MADV_POPULATE_WRITE)\\\\n\\\", ret); ir a limpieza; } /* Perfora el archivo para aplicar la divisi\u00f3n xarray */ ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); if (ret) fprintf(stderr, \\\"Error %d al fallacate()\\\\n\\\", ret); limpieza: if (buf != (void *)-1) munmap(buf, TEST_MEM_SIZE); si (fd \u0026gt; 0) cerrar(fd); devolver 0; } # gcc test.c -o prueba # cat /proc/1/smaps | grep Tama\u00f1o de p\u00e1gina de kernel | head -n 1 KernelPageSize: 64 kB # ./test shmem : ------------[ cortar aqu\u00ed ]------------ ADVERTENCIA: CPU: 17 PID: 5253 en lib/xarray.c:1025 xas_split_alloc+0xf8/0x128 M\u00f3dulos vinculados en: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib \\\\ nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct \\\\ nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 \\\\ ip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon \\\\ drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 \\\\ virtio_net sha1_ce net_failover failover virtio_console virtio_blk \\\\ dimlib virtio_mmio CPU: 17 PID: 5253 Comm: prueba Kdump: cargado Contaminado: GW 6.10.0-rc5-gavin+ #12  ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.6.41\",\"matchCriteriaId\":\"CB8B6FE0-8AA9-42BD-BCE9-F8A593A9F032\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/099d90642a711caae377f53309abfe27e8724a8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/333c5539a31f48828456aa9997ec2808f06a699a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a0c42ddd0969fdc760a85e20e267776028a7ca4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.