Linux Kernel Walk Cache Invalidation Vulnerability When Unsharing PMD Tables on ARM64

A vulnerability in the Linux kernel's handling of page table entries can lead to incorrect page table walks on ARM64 architectures. This issue arises when the 'huge_pmd_unshare()' function is called to unshare a PMD table. The 'tlb_unshare_pmd_ptdesc()' function sets 'tlb->unshared_tables=true', but the subsequent 'tlb_flush()' call only checks 'tlb->freed_tables'. As a result, stale PMD page table entries can remain in the walk cache, potentially causing errors in page table traversal.

Impact

Failure to properly invalidate the walk cache can lead to incorrect page table walks, causing potential memory management errors or misbehavior in processes that rely on accurate page table information.

Reproduction

To reproduce this vulnerability, unshare a PMD table using the 'huge_pmd_unshare()' function on an ARM64 system. After unsharing, the 'tlb_flush()' function will not correctly invalidate the walk cache, allowing stale PMD entries to remain and disrupt page table walks.

Remediation

The vulnerability has been addressed by modifying the 'tlb_flush()' function to check both 'tlb->freed_tables' and 'tlb->unshared_tables'. This change ensures that the walk cache is properly invalidated when PMD tables are unshared.