The read-only THP for filesystems would collapse THP for file opened
readonly and mapped with VM_EXEC, the intended usecase is to avoid TLB
miss for large text segment. But it doesn't restrict the file types so
THP could be collapsed for non-regular file, for example, block device,
if it is opened readonly and mapped with EXEC permission. This may
cause bugs, like [1] and [2].
This is definitely not intended usecase, so just collapsing THP for regular
file in order to close the attack surface.
[1] https://lore.kernel.org/lkml/CACkBjsYwLYLRmX8GpsDpMthagWOjWWrNxqY6ZLNQVr6yx+f5vA@mail.gmail.com/
[2] https://lore.kernel.org/linux-mm/[email protected]/
Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
Reported-by: Hao Sun <[email protected]>
Reported-by: [email protected]
Cc: Hao Sun <[email protected]>
Cc: Matthew Wilcox <[email protected]>
Cc: Kirill A. Shutemov <[email protected]>
Cc: Song Liu <[email protected]>
Cc: Andrea Righi <[email protected]>
Cc: <[email protected]>
Signed-off-by: Hugh Dickins <[email protected]>
Signed-off-by: Yang Shi <[email protected]>
---
The patch is basically based off the proposal from Hugh
(https://lore.kernel.org/linux-mm/[email protected]/).
It seems Hugh is too busy to prepare the patch for formal submission (I
didn't hear from him by pinging him a couple of times on mailing list),
so I prepared the patch and added his SOB.
mm/khugepaged.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 045cc579f724..e91b7271275e 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -445,22 +445,25 @@ static bool hugepage_vma_check(struct vm_area_struct *vma,
if (!transhuge_vma_enabled(vma, vm_flags))
return false;
- /* Enabled via shmem mount options or sysfs settings. */
- if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) {
+ if (vma->vm_file)
return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
HPAGE_PMD_NR);
- }
+
+ /* Enabled via shmem mount options or sysfs settings. */
+ if (shmem_file(vma->vm_file))
+ return shmem_huge_enabled(vma);
/* THP settings require madvise. */
if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always())
return false;
- /* Read-only file mappings need to be aligned for THP to work. */
+ /* Only regular file is valid */
if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file &&
- !inode_is_open_for_write(vma->vm_file->f_inode) &&
(vm_flags & VM_EXEC)) {
- return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
- HPAGE_PMD_NR);
+ struct inode *inode = vma->vm_file->f_inode;
+
+ return !inode_is_open_for_write(inode) &&
+ S_ISREG(inode->i_mode);
}
if (!vma->anon_vma || vma->vm_ops)
--
2.26.2
On Wed, Oct 27, 2021 at 12:52:21PM -0700, Yang Shi wrote:
> +++ b/mm/khugepaged.c
> @@ -445,22 +445,25 @@ static bool hugepage_vma_check(struct vm_area_struct *vma,
> if (!transhuge_vma_enabled(vma, vm_flags))
> return false;
>
> - /* Enabled via shmem mount options or sysfs settings. */
> - if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) {
> + if (vma->vm_file)
> return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
> HPAGE_PMD_NR);
> - }
> +
> + /* Enabled via shmem mount options or sysfs settings. */
> + if (shmem_file(vma->vm_file))
> + return shmem_huge_enabled(vma);
This doesn't make sense to me. if vma->vm_file, we already returned,
so this is dead code.
> /* THP settings require madvise. */
> if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always())
> return false;
>
> - /* Read-only file mappings need to be aligned for THP to work. */
> + /* Only regular file is valid */
> if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file &&
> - !inode_is_open_for_write(vma->vm_file->f_inode) &&
> (vm_flags & VM_EXEC)) {
> - return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
> - HPAGE_PMD_NR);
> + struct inode *inode = vma->vm_file->f_inode;
> +
> + return !inode_is_open_for_write(inode) &&
> + S_ISREG(inode->i_mode);
> }
>
> if (!vma->anon_vma || vma->vm_ops)
> --
> 2.26.2
>
> On Oct 27, 2021, at 12:52 PM, Yang Shi <[email protected]> wrote:
>
> The read-only THP for filesystems would collapse THP for file opened
> readonly and mapped with VM_EXEC, the intended usecase is to avoid TLB
> miss for large text segment. But it doesn't restrict the file types so
> THP could be collapsed for non-regular file, for example, block device,
> if it is opened readonly and mapped with EXEC permission. This may
> cause bugs, like [1] and [2].
>
> This is definitely not intended usecase, so just collapsing THP for regular
> file in order to close the attack surface.
>
> [1] https://lore.kernel.org/lkml/CACkBjsYwLYLRmX8GpsDpMthagWOjWWrNxqY6ZLNQVr6yx+f5vA@mail.gmail.com/
> [2] https://lore.kernel.org/linux-mm/[email protected]/
>
> Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
> Reported-by: Hao Sun <[email protected]>
> Reported-by: [email protected]
> Cc: Hao Sun <[email protected]>
> Cc: Matthew Wilcox <[email protected]>
> Cc: Kirill A. Shutemov <[email protected]>
> Cc: Song Liu <[email protected]>
> Cc: Andrea Righi <[email protected]>
> Cc: <[email protected]>
> Signed-off-by: Hugh Dickins <[email protected]>
> Signed-off-by: Yang Shi <[email protected]>
> ---
> The patch is basically based off the proposal from Hugh
> (https://lore.kernel.org/linux-mm/[email protected]/).
> It seems Hugh is too busy to prepare the patch for formal submission (I
> didn't hear from him by pinging him a couple of times on mailing list),
> so I prepared the patch and added his SOB.
>
> mm/khugepaged.c | 17 ++++++++++-------
> 1 file changed, 10 insertions(+), 7 deletions(-)
>
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 045cc579f724..e91b7271275e 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -445,22 +445,25 @@ static bool hugepage_vma_check(struct vm_area_struct *vma,
> if (!transhuge_vma_enabled(vma, vm_flags))
> return false;
>
> - /* Enabled via shmem mount options or sysfs settings. */
> - if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) {
> + if (vma->vm_file)
> return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
> HPAGE_PMD_NR);
Am I misreading this? If we return here for vma->vm_file, the following
logic (shmem_file(), etc.) would be skipped, no?
Thanks,
Song
> - }
> +
> + /* Enabled via shmem mount options or sysfs settings. */
> + if (shmem_file(vma->vm_file))
> + return shmem_huge_enabled(vma);
>
> /* THP settings require madvise. */
> if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always())
> return false;
>
> - /* Read-only file mappings need to be aligned for THP to work. */
> + /* Only regular file is valid */
> if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file &&
> - !inode_is_open_for_write(vma->vm_file->f_inode) &&
> (vm_flags & VM_EXEC)) {
> - return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
> - HPAGE_PMD_NR);
> + struct inode *inode = vma->vm_file->f_inode;
> +
> + return !inode_is_open_for_write(inode) &&
> + S_ISREG(inode->i_mode);
> }
>
> if (!vma->anon_vma || vma->vm_ops)
> --
> 2.26.2
>