From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.6 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, FSL_HELO_FAKE,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5F1FC2BB1D for ; Thu, 12 Mar 2020 20:16:08 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7ACE3206E2 for ; Thu, 12 Mar 2020 20:16:08 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="X/r/XGA7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7ACE3206E2 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EEDA16B0003; Thu, 12 Mar 2020 16:16:07 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E9E2E6B0006; Thu, 12 Mar 2020 16:16:07 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D66FC6B0007; Thu, 12 Mar 2020 16:16:07 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0212.hostedemail.com [216.40.44.212]) by kanga.kvack.org (Postfix) with ESMTP id BBC386B0003 for ; Thu, 12 Mar 2020 16:16:07 -0400 (EDT) Received: from smtpin04.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 8039911819 for ; Thu, 12 Mar 2020 20:16:07 +0000 (UTC) X-FDA: 76587816774.04.pen88_18463eb0f375a X-HE-Tag: pen88_18463eb0f375a X-Filterd-Recvd-Size: 7294 Received: from mail-pl1-f194.google.com (mail-pl1-f194.google.com [209.85.214.194]) by imf42.hostedemail.com (Postfix) with ESMTP for ; Thu, 12 Mar 2020 20:16:06 +0000 (UTC) Received: by mail-pl1-f194.google.com with SMTP id j20so3101618pll.6 for ; Thu, 12 Mar 2020 13:16:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=5ODS1TFq9M93gWOQaGQ9WOy3EnmI/QAeYw+Gw8Sae8Y=; b=X/r/XGA7oK6/08aLFZb7cozSoP5Ox1n14lQ/b7pmAbgOSH2AocxqP3VTQCE0IZIiEd 7Zhj7R74pgBIrG0Pzay4Gkz6RDMMjmTiLZcvnzN2QPzxKKxO66lDtOrSjWHseef3d0pW ko9LF2Cs3ROzOveWcMSMwJHX2in4UoFIdhsLMreC837s5gRVUvllRNCA4ZrLFrBxGeIY CDMqpHqo4KrY+cEQ1gxsRqPg84TWv1Ivf1loHceNVXenOgD+P9rXKfQZsfS5270ulRIH VwlwZkGDfbH0TRQcqiZ2Nm4xTaxFFLWi70hGeLwQVHhbOmk6puQP1n0/RPatfLZ4wQ7T iNpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-disposition:in-reply-to:user-agent; bh=5ODS1TFq9M93gWOQaGQ9WOy3EnmI/QAeYw+Gw8Sae8Y=; b=AaKehWVs2fGtgUeQ3YO3sTr5dery8CqIMOx2kmNeWoP2VMGVjRTqoROHrH9aayqHpG Xgzci3q5p6lkYoztRYLKL/m1kontU9lBpMWkcsDR2kPid6EuS7nWCKBXtOFzt7znm5kF pHUxayOdaOacUSLkNHmHHnSm+oYZXf2ySVcAl1Za8EL0ss3QDz9a62zY9Q3ZZRnTNNHU ThHK9q7TTghAZqYr8mQCi702C0RpggM6793mymcm4q6xzJy1v/KeaCMNhSkUJ44TREC5 idB6JXRpk0imM8tr2DNLzn2ueiTqbtS/tbSqZdNHyttTe4JqSAfYt3M8Ex+6oYO9orkF 4Q0w== X-Gm-Message-State: ANhLgQ0revRslUD6KKFp10QcLbJiCxFYV0l9XfJSfC4zjoKBp/LODGCj 1L9qdTr4N9vOt6+KGLs668E= X-Google-Smtp-Source: ADFU+vvSu5zD+w3Hi1A+OEefWgIKYLlwm40V2B013hdA5Huw5+NpY8qb95G53euZlUZM/kZuEzZlVQ== X-Received: by 2002:a17:90a:fa81:: with SMTP id cu1mr5864534pjb.192.1584044165162; Thu, 12 Mar 2020 13:16:05 -0700 (PDT) Received: from google.com ([2620:15c:211:1:3e01:2939:5992:52da]) by smtp.gmail.com with ESMTPSA id b10sm5078236pfo.215.2020.03.12.13.16.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Mar 2020 13:16:03 -0700 (PDT) Date: Thu, 12 Mar 2020 13:16:02 -0700 From: Minchan Kim To: Michal Hocko Cc: Jann Horn , Linux-MM , kernel list , Daniel Colascione , Dave Hansen , "Joel Fernandes (Google)" , Andrew Morton Subject: Re: interaction of MADV_PAGEOUT with CoW anonymous mappings? Message-ID: <20200312201602.GA68817@google.com> References: <20200312082248.GS23944@dhcp22.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200312082248.GS23944@dhcp22.suse.cz> User-Agent: Mutt/1.12.2 (2019-09-21) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Mar 12, 2020 at 09:22:48AM +0100, Michal Hocko wrote: > [Cc akpm] > > So what about this? Thanks, Michal. I't likde to wait Jann's reply since Dave gave his opinion about the vulnerability. https://lore.kernel.org/linux-mm/cf95db88-968d-fee5-1c15-10d024c09d8a@intel.com/ Jann, could you give your insigh about that practically it's possible? A real dumb question to understand vulnerability: The attacker would be able to trigger heavy memory consumption so that he could make paging them out without MADV_PAGEOUT. I know MADV_PAGEOUT makes it easier but he still could do without MADV_PAGEOUT. What makes difference here? To clarify how MADV_PAGEWORK works: If other process has accessed the page so that his page table has access bit marked, MADV_PAGEOUT couldn't page it out. > > From eca97990372679c097a88164ff4b3d7879b0e127 Mon Sep 17 00:00:00 2001 > From: Michal Hocko > Date: Thu, 12 Mar 2020 09:04:35 +0100 > Subject: [PATCH] mm: do not allow MADV_PAGEOUT for CoW pages > > Jann has brought up a very interesting point [1]. While shared pages are > excluded from MADV_PAGEOUT normally, CoW pages can be easily reclaimed > that way. This can lead to all sorts of hard to debug problems. E.g. > performance problems outlined by Daniel [2]. There are runtime > environments where there is a substantial memory shared among security > domains via CoW memory and a easy to reclaim way of that memory, which > MADV_{COLD,PAGEOUT} offers, can lead to either performance degradation > in for the parent process which might be more privileged or even open > side channel attacks. The feasibility of the later is not really clear I am not sure it's a good idea to mention performance stuff because it's rather arguble. You and Johannes already pointed it out when I sbumit early draft which had shared page filtering out logic due to performance reason. You guys suggested the shared pages has higher chance to be touched so that if it's really hot pages, that whould keep in the memory. I agree. I think the only reason at this moment is just vulnerability. > to me TBH but there is no real reason for exposure at this stage. It > seems there is no real use case to depend on reclaiming CoW memory via > madvise at this stage so it is much easier to simply disallow it and > this is what this patch does. Put it simply MADV_{PAGEOUT,COLD} can > operate only on the exclusively owned memory which is a straightforward > semantic. > > [1] http://lkml.kernel.org/r/CAG48ez0G3JkMq61gUmyQAaCq=_TwHbi1XKzWRooxZkv08PQKuw@mail.gmail.com > [2] http://lkml.kernel.org/r/CAKOZueua_v8jHCpmEtTB6f3i9e2YnmX4mqdYVWhV4E=Z-n+zRQ@mail.gmail.com > > Signed-off-by: Michal Hocko > --- > mm/madvise.c | 12 +++++++++--- > 1 file changed, 9 insertions(+), 3 deletions(-) > > diff --git a/mm/madvise.c b/mm/madvise.c > index 43b47d3fae02..4bb30ed6c8d2 100644 > --- a/mm/madvise.c > +++ b/mm/madvise.c > @@ -335,12 +335,14 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, > } > > page = pmd_page(orig_pmd); > + > + /* Do not interfere with other mappings of this page */ How about this? /* * paging out only single mapped private pages for anonymous mapping, * otherwise, it opens a side channel. */ Otherwise, looks good to me. > + if (page_mapcount(page) != 1) > + goto huge_unlock; > + > if (next - addr != HPAGE_PMD_SIZE) { > int err; > > - if (page_mapcount(page) != 1) > - goto huge_unlock; > - > get_page(page); > spin_unlock(ptl); > lock_page(page); > @@ -426,6 +428,10 @@ static int madvise_cold_or_pageout_pte_range(pmd_t *pmd, > continue; > } > > + /* Do not interfere with other mappings of this page */ > + if (page_mapcount(page) != 1) > + continue; > + > VM_BUG_ON_PAGE(PageTransCompound(page), page); > > if (pte_young(ptent)) { > -- > 2.24.1 > > -- > Michal Hocko > SUSE Labs