"value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray\n\nPatch series \"mm/filemap: Limit page cache size to that supported by\nxarray\", v2.\n\nCurrently, xarray can't support arbitrary page cache size. More details\ncan be found from the WARN_ON() statement in xas_split_alloc(). In our\ntest whose code is attached below, we hit the WARN_ON() on ARM64 system\nwhere the base page size is 64KB and huge page size is 512MB. The issue\nwas reported long time ago and some discussions on it can be found here\n[1].\n\n[1] https://www.spinics.net/lists/linux-xfs/msg75404.html\n\nIn order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one\nsupported by xarray and avoid PMD-sized page cache if needed. The code\nchanges are suggested by David Hildenbrand.\n\nPATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray\nPATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path\nPATCH[4] avoids PMD-sized page cache for shmem files if needed\n\nTest program\n============\n# cat test.c\n#define _GNU_SOURCE\n#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n#include <string.h>\n#include <fcntl.h>\n#include <errno.h>\n#include <sys/syscall.h>\n#include <sys/mman.h>\n\n#define TEST_XFS_FILENAME\t\"/tmp/data\"\n#define TEST_SHMEM_FILENAME\t\"/dev/shm/data\"\n#define TEST_MEM_SIZE\t\t0x20000000\n\nint main(int argc, char **argv)\n{\n\tconst char *filename;\n\tint fd = 0;\n\tvoid *buf = (void *)-1, *p;\n\tint pgsize = getpagesize();\n\tint ret;\n\n\tif (pgsize != 0x10000) {\n\t\tfprintf(stderr, \"64KB base page size is required\\n\");\n\t\treturn -EPERM;\n\t}\n\n\tsystem(\"echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled\");\n\tsystem(\"rm -fr /tmp/data\");\n\tsystem(\"rm -fr /dev/shm/data\");\n\tsystem(\"echo 1 > /proc/sys/vm/drop_caches\");\n\n\t/* Open xfs or shmem file */\n\tfilename = TEST_XFS_FILENAME;\n\tif (argc > 1 && !strcmp(argv[1], \"shmem\"))\n\t\tfilename = TEST_SHMEM_FILENAME;\n\n\tfd = open(filename, O_CREAT | O_RDWR | O_TRUNC);\n\tif (fd < 0) {\n\t\tfprintf(stderr, \"Unable to open <%s>\\n\", filename);\n\t\treturn -EIO;\n\t}\n\n\t/* Extend file size */\n\tret = ftruncate(fd, TEST_MEM_SIZE);\n\tif (ret) {\n\t\tfprintf(stderr, \"Error %d to ftruncate()\\n\", ret);\n\t\tgoto cleanup;\n\t}\n\n\t/* Create VMA */\n\tbuf = mmap(NULL, TEST_MEM_SIZE,\n\t\t PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);\n\tif (buf == (void *)-1) {\n\t\tfprintf(stderr, \"Unable to mmap <%s>\\n\", filename);\n\t\tgoto cleanup;\n\t}\n\n\tfprintf(stdout, \"mapped buffer at 0x%p\\n\", buf);\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);\n if (ret) {\n\t\tfprintf(stderr, \"Unable to madvise(MADV_HUGEPAGE)\\n\");\n\t\tgoto cleanup;\n\t}\n\n\t/* Populate VMA */\n\tret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE);\n\tif (ret) {\n\t\tfprintf(stderr, \"Error %d to madvise(MADV_POPULATE_WRITE)\\n\", ret);\n\t\tgoto cleanup;\n\t}\n\n\t/* Punch the file to enforce xarray split */\n\tret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,\n \t\tTEST_MEM_SIZE - pgsize, pgsize);\n\tif (ret)\n\t\tfprintf(stderr, \"Error %d to fallocate()\\n\",ret);\n\ncleanup:\n\tif(buf!=(void*)-1)\n\t\tmunmap(buf,TEST_MEM_SIZE);\n\tif(fd>0)\n\t\tclose(fd);\n\n\treturn0;\n}\n\n#gcctest.c-otest\n#cat/proc/1/smaps|grepKernelPageSize|head-n1\nKernelPageSize:64kB\n#./testshmem\n:\n------------[cuthere]------------\nWARNING:CPU:17PID:5253atlib/xarray.c:1025xas_split_alloc+0xf8/0x128\nModuleslinkedin:nft_fib_inetnft_fib_ipv4nft_fib_ipv6nft_fib\\\nnft_reject_inetnf_reject_ipv4nf_reject_ipv6nft_rejectnft_ct\\\nnft_chain_natnf_natnf_conntracknf_defrag_ipv6nf_defrag_ipv4\\\nip_setnf_tablesrfkillnfnetlinkvfatfatvirtio_balloon\\\ndrmfusexfslibcrc32ccrct10dif_ceghash_cesha2_cesha256_arm64\\\nvirtio_netsha1_cenet_failoverfailovervirtio_consolevirtio_blk\\\ndimlibvirtio_mmio\nCPU:17PID:5253Comm:testKdump:loade
"value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/filemap: hacer que MAX_PAGECACHE_ORDER sea aceptable para xarray Serie de parches \"mm/filemap: limitar el tama\u00f1o de cach\u00e9 de p\u00e1gina al admitido por xarray\", v2. Actualmente, xarray no puede admitir un tama\u00f1o de cach\u00e9 de p\u00e1gina arbitrario. Se pueden encontrar m\u00e1s detalles en la declaraci\u00f3n WARN_ON() en xas_split_alloc(). En nuestra prueba cuyo c\u00f3digo se adjunta a continuaci\u00f3n, presionamos WARN_ON() en el sistema ARM64 donde el tama\u00f1o de p\u00e1gina base es de 64 KB y el tama\u00f1o de p\u00e1gina enorme es de 512 MB. El problema se inform\u00f3 hace mucho tiempo y se pueden encontrar algunas discusiones al respecto aqu\u00ed [1]. [1] https://www.spinics.net/lists/linux-xfs/msg75404.html Para solucionar el problema, debemos ajustar MAX_PAGECACHE_ORDER a uno compatible con xarray y evitar el cach\u00e9 de p\u00e1ginas del tama\u00f1o de PMD si es necesario. Los cambios de c\u00f3digo los sugiere David Hildenbrand. PATCH[1] ajusta MAX_PAGECACHE_ORDER al soportado por xarray PATCH[2-3] evita el cach\u00e9 de p\u00e1ginas de tama\u00f1o PMD en la ruta de lectura anticipada sincr\u00f3nica PATCH[4] evita el cach\u00e9 de p\u00e1ginas de tama\u00f1o PMD para archivos shmem si es necesario Programa de prueba ===== ======= # cat test.c #define _GNU_SOURCE #incluye #incluye #incluye #incluye #incluye #include #include #include #define TEST_XFS_FILENAME \"/tmp/data\" #define TEST_SHMEM_FILENAME \"/dev/shm/data\" #define TEST_MEM_SIZE 0x20000000 int main(int argc, char **argv) { const char *nombre de archivo; intfd = 0; vac\u00edo *buf = (vac\u00edo *)-1, *p; int pgsize = getpagesize(); ret int; if (pgsize != 0x10000) { fprintf(stderr, \"se requiere un tama\u00f1o de p\u00e1gina base de 64 KB\\n\"); devolver -EPERM; } system(\"echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled\"); sistema(\"rm -fr /tmp/data\"); sistema(\"rm -fr /dev/shm/data\"); sistema(\"echo 1 > /proc/sys/vm/drop_caches\"); /* Abrir archivo xfs o shmem */ filename = TEST_XFS_FILENAME; if (argc > 1 && !strcmp(argv[1], \"shmem\")) nombre de archivo = TEST_SHMEM_FILENAME; fd = open(nombre de archivo, O_CREAT | O_RDWR | O_TRUNC); if (fd < 0) { fprintf(stderr, \"No se puede abrir <%s>\\n\", nombre de archivo); devolver -EIO; } /* Ampliar tama\u00f1o de archivo */ ret = ftruncate(fd, TEST_MEM_SIZE); if (ret) { fprintf(stderr, \"Error %d al ftruncate()\\n\", ret); ir a limpieza; } /* Crear VMA */ buf = mmap(NULL, TEST_MEM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (buf == (void *)-1) { fprintf(stderr, \"No se puede mmap <%s>\\n\", nombre de archivo); ir a limpieza; } fprintf(stdout, \"b\u00fafer asignado en 0x%p\\n\", buf); ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE); if (ret) { fprintf(stderr, \"No se puede madvise(MADV_HUGEPAGE)\\n\"); ir a limpieza; } /* Completar VMA */ ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE); if (ret) { fprintf(stderr, \"Error %d en madvise(MADV_POPULATE_WRITE)\\n\", ret); ir a limpieza; } /* Perfora el archivo para aplicar la divisi\u00f3n xarray */ ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE, TEST_MEM_SIZE - pgsize, pgsize); if (ret) fprintf(stderr, \"Error %d al fallacate()\\n\",ret);limpieza:if(buf!=(void*)-1)munmap(buf,TEST_MEM_SIZE);si(fd>0)cerrar(fd);devolver0;}#gcctest.c-oprueba#cat/proc/1/smaps|grepTama\u00f1odep\u00e1ginadekernel|head-n1KernelPageSize:64kB#./testshmem:------------[cortaraqu\u00ed]------------ADVERTENCIA:CPU:17PID:5253enlib/xarray.c:1025xas_split_alloc+0xf8/0x128M\u00f3dulosvinculadosen:nft_fib_inetnft_fib_ipv4nft_fib_ipv6nft_fib\\nft_reject_inetnf_reject_ipv4nf_reject_ipv6nft_rejectnft_ct\\natnf_natnf_conntracknf_defrag_ipv6nf_defrag_ipv4\\ip_setnf_tablesrfkillnfnetlinkvfatfatvirtio_balloon\\drmfusexfslibcrc32ccrct10dif_ceghash_cesha2_cesha256_arm64\\virtio_netsha1_cenet_failoverfailove
