Received: by 2002:ac0:8c9a:0:0:0:0:0 with SMTP id r26csp150595ima; Fri, 1 Feb 2019 00:56:55 -0800 (PST) X-Google-Smtp-Source: ALg8bN53uNTa2l3s/S/zm9PhLD4yDbOvzV8OYK3EbBFYku79olhFjTPqnSQk0KK+5YLkFtHNrUEi X-Received: by 2002:a62:fb07:: with SMTP id x7mr38150699pfm.71.1549011415049; Fri, 01 Feb 2019 00:56:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1549011415; cv=none; d=google.com; s=arc-20160816; b=BqpikE2JtRmya5V87LWAquhUs6hAwPMbONew/R57XbtTylrEBy6ERz6pWVi1wwxLHu KbI1ncJeW3yR4V9kZp6DQP/DAXg1GAlOGT934veHAPNd5dHI4CWfYkdBYfLtk4N+9xWM KMkMm39kBUb1+EZzsxLyesau4TIfDnJQSAJ2JNrDxr5CpST0vayUmjsLYSdQVq3i8o9/ nDX1tO1zFwwr7ihzuZZL36oqTPL0r5MpM9zZzigf7sxqvtKsVf3qrqO9S/sgMdCCWKeN zNERnkkzHHcIHbluyHWW2nL5CaaxflPTShQtO/pV66UL/SzwldEO37Ry/tggnWugPvrW mMnw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding :content-language:in-reply-to:mime-version:user-agent:date :message-id:openpgp:from:references:cc:to:subject; bh=WrXnCZ+PGX6lzv+WoXBqVgVFhevifRruGkRrCB1xf/Q=; b=HW4J7thrVD4wX5bdDRJqRI3ZJ6Wp4gdYkEeLGyakpaHusPsllG2cLXZ+a3sWJ/FjZi c67b/usgztQxnTwg9blCMK7n58F97Izc3zLUpg6H2XWlF7pkvaelIqYfW0sQ0EkCwAmy KHREweWi6aezb1eaLmgc15NJNCz2zPPh1QGPW8suGekpt90q1WcNCJt3agzcX77eRHFe 0HDi/wne6AkCfNv9FpSkGFGE3OzKvUzvedYaw2li0Qno8Fs4VuFiWJefX19SVH2GqyDC d4xPUX7LKYtUahHhQKPSHRBHV3VT87G6yEiqm5jOhSkE2zKWIhgxI6gimHGeHtdx+MER GJng== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e68si7009171pfb.101.2019.02.01.00.56.39; Fri, 01 Feb 2019 00:56:55 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726699AbfBAI4T (ORCPT + 99 others); Fri, 1 Feb 2019 03:56:19 -0500 Received: from mx2.suse.de ([195.135.220.15]:45466 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725876AbfBAI4S (ORCPT ); Fri, 1 Feb 2019 03:56:18 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 6CECAAED0; Fri, 1 Feb 2019 08:56:16 +0000 (UTC) Subject: Re: [PATCH 1/3] mm/mincore: make mincore() more conservative To: Andrew Morton , Linus Torvalds Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-api@vger.kernel.org, Peter Zijlstra , Greg KH , Jann Horn , Jiri Kosina , Dominique Martinet , Andy Lutomirski , Dave Chinner , Kevin Easton , Matthew Wilcox , Cyril Hrubis , Tejun Heo , "Kirill A . Shutemov" , Daniel Gruss , Jiri Kosina References: <20190130124420.1834-1-vbabka@suse.cz> <20190130124420.1834-2-vbabka@suse.cz> From: Vlastimil Babka Openpgp: preference=signencrypt Message-ID: Date: Fri, 1 Feb 2019 09:56:14 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.4.0 MIME-Version: 1.0 In-Reply-To: <20190130124420.1834-2-vbabka@suse.cz> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Here's updated version with Michal's suggestion, and acks: I think this patch is fine to go, less sure about 2/3 and 3/3. ----8<---- From 49f17d9f6a42ecc2a508125b0c880ff0402a6f49 Mon Sep 17 00:00:00 2001 From: Jiri Kosina Date: Wed, 16 Jan 2019 20:53:17 +0100 Subject: [PATCH v2] mm/mincore: make mincore() more conservative The semantics of what mincore() considers to be resident is not completely clear, but Linux has always (since 2.3.52, which is when mincore() was initially done) treated it as "page is available in page cache". That's potentially a problem, as that [in]directly exposes meta-information about pagecache / memory mapping state even about memory not strictly belonging to the process executing the syscall, opening possibilities for sidechannel attacks. Change the semantics of mincore() so that it only reveals pagecache information for non-anonymous mappings that belog to files that the calling process could (if it tried to) successfully open for writing. [mhocko@suse.com: restructure can_do_mincore() conditions] Originally-by: Linus Torvalds Originally-by: Dominique Martinet Cc: Dominique Martinet Cc: Andy Lutomirski Cc: Dave Chinner Cc: Kevin Easton Cc: Matthew Wilcox Cc: Cyril Hrubis Cc: Tejun Heo Cc: Kirill A. Shutemov Cc: Daniel Gruss Signed-off-by: Jiri Kosina Signed-off-by: Vlastimil Babka Acked-by: Josh Snyder Acked-by: Michal Hocko --- mm/mincore.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/mm/mincore.c b/mm/mincore.c index 218099b5ed31..b8842b849604 100644 --- a/mm/mincore.c +++ b/mm/mincore.c @@ -169,6 +169,16 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, return 0; } +static inline bool can_do_mincore(struct vm_area_struct *vma) +{ + if (vma_is_anonymous(vma)) + return true; + if (!vma->vm_file) + return false; + return inode_owner_or_capable(file_inode(vma->vm_file)) || + inode_permission(file_inode(vma->vm_file), MAY_WRITE) == 0; +} + /* * Do a chunk of "sys_mincore()". We've already checked * all the arguments, we hold the mmap semaphore: we should @@ -189,8 +199,13 @@ static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *v vma = find_vma(current->mm, addr); if (!vma || addr < vma->vm_start) return -ENOMEM; - mincore_walk.mm = vma->vm_mm; end = min(vma->vm_end, addr + (pages << PAGE_SHIFT)); + if (!can_do_mincore(vma)) { + unsigned long pages = (end - addr) >> PAGE_SHIFT; + memset(vec, 1, pages); + return pages; + } + mincore_walk.mm = vma->vm_mm; err = walk_page_range(addr, end, &mincore_walk); if (err < 0) return err; -- 2.20.1