Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #68922 > unrolled thread

Bug#977615: arm64: memory corruption bug

Back to article view | Back to linux.debian.kernel

Contents

  Bug#977615: arm64: memory corruption bug Noah Meyerhans <noahm@debian.org> - 2020-12-17 21:20 +0100
    Bug#977615: arm64: memory corruption bug Salvatore Bonaccorso <carnil@debian.org> - 2020-12-17 21:30 +0100
      Bug#977615: arm64: memory corruption bug Noah Meyerhans <noahm@debian.org> - 2020-12-17 23:00 +0100

#68922 — Bug#977615: arm64: memory corruption bug

Package: src:linux
Version: 4.19.160-2
Severity: important
Tags: upstream fixed-upstream
Control: fixed -1 5.9.15-1
Control: fixed -1 5.10~rc7-1~exp1
Control: found -1 5.9.11-1

Opening a bug for visibility.  Arguably this could be Severity: grave given
that memory corruption can lead to data loss.  It has been fixed upstream in
4.19.161, 5.9.12, and 5.10.  I'm not sure about the status for 4.9/stretch
LTS.

There is a memory corruption bug impacting arm64.  The upstream fix was made
in 5.10 with commit ff1712f953e2 ("arm64: pgtable: Ensure dirty bit is
preserved across pte_wrprotect()").  The upstream commit [1] describes the
issue as:

        With hardware dirty bit management, calling pte_wrprotect() on a
        writable, dirty PTE will lose the dirty state and return a
        read-only, clean entry.

Impact from the issue has been observed in the real world on systems running
redis, as described at https://github.com/redis/redis/issues/8124 (note in
particular comments [2] and [3], where the kernel connection is made).

1. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff1712f953e27f0b0718762ec17d0adb15c9fd0b
2. https://github.com/redis/redis/issues/8124#issuecomment-745791340
3. https://github.com/redis/redis/issues/8124#issuecomment-745838911

[toc] | [next] | [standalone]

#68923

Hi,

On Thu, Dec 17, 2020 at 08:08:28PM +0000, Noah Meyerhans wrote:
> Package: src:linux
> Version: 4.19.160-2
> Severity: important
> Tags: upstream fixed-upstream
> Control: fixed -1 5.9.15-1
> Control: fixed -1 5.10~rc7-1~exp1
> Control: found -1 5.9.11-1
> 
> Opening a bug for visibility.  Arguably this could be Severity: grave given
> that memory corruption can lead to data loss.  It has been fixed upstream in
> 4.19.161, 5.9.12, and 5.10.  I'm not sure about the status for 4.9/stretch
> LTS.
> 
> There is a memory corruption bug impacting arm64.  The upstream fix was made
> in 5.10 with commit ff1712f953e2 ("arm64: pgtable: Ensure dirty bit is
> preserved across pte_wrprotect()").  The upstream commit [1] describes the
> issue as:
> 
>         With hardware dirty bit management, calling pte_wrprotect() on a
>         writable, dirty PTE will lose the dirty state and return a
>         read-only, clean entry.
> 
> Impact from the issue has been observed in the real world on systems running
> redis, as described at https://github.com/redis/redis/issues/8124 (note in
> particular comments [2] and [3], where the kernel connection is made).
> 
> 1. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff1712f953e27f0b0718762ec17d0adb15c9fd0b
> 2. https://github.com/redis/redis/issues/8124#issuecomment-745791340
> 3. https://github.com/redis/redis/issues/8124#issuecomment-745838911

Thanks. Pending currently with the ongoing rebase in the v4.19.y
series in
https://salsa.debian.org/kernel-team/linux/-/merge_requests/295 .

Just we need to check if this warrants a regression update issued
earlier via stable-updates.

Salvatore

[toc] | [prev] | [next] | [standalone]

#68932

> Thanks. Pending currently with the ongoing rebase in the v4.19.y
> series in
> https://salsa.debian.org/kernel-team/linux/-/merge_requests/295 .
> 
> Just we need to check if this warrants a regression update issued
> earlier via stable-updates.

If possible, I'd vote for an release via stable-updates, and I'd be
happy to put together a merge request for such a release.

It seems that the bug is triggered during relatively uncommon
circumstances (CoW and MADVISE_FREE used together), but in places where
it is triggered, the impact is severe and there is no practical
workaround.

noah

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web