Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp1488443yba; Thu, 25 Apr 2019 00:09:16 -0700 (PDT) X-Google-Smtp-Source: APXvYqwJ4geK4dWwyTL+ts16xm57Lub6KWBebNgk6hhEyd8bha6eNFv7x9+CHqdHJxP96HSpWziE X-Received: by 2002:a62:7089:: with SMTP id l131mr39485361pfc.158.1556176156034; Thu, 25 Apr 2019 00:09:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1556176156; cv=none; d=google.com; s=arc-20160816; b=Yk7Z4ILmJK+sRcUVk2Khm8z3Tw5gx60yjJ90EnxKboQ01h6qtObJxJBBxOOswVcCOr H42/3Xv3M/4gwtCG8cRDq+RV2ei52xIs75/uiYVJnREtF/8Wze/7t6dLfgS9PtLIsxej XBVGR0iMXtZtLkryPnYXkWOZQcyuabu8kBVwLqFSMT7ybYPQdATTxAROdEoYD13hsNKA 5P2I9U1jV8f6k8Qd6r/lvaSEmXfNkmFAK0YIwgutdrZDSIM6ut8yK3+T69SqI8oUN9bK b7J5zgXKtkfwMwpHto/0rdSii6Mw0t4bnxrfeQ5nTWWaEdXJX8pobbUTg15XbvaB+AoZ Rfrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:from:subject:references :mime-version:message-id:in-reply-to:date:dkim-signature; bh=EEx6KKB2U0RJZ21EFlDN1R7C1ruUVShWYlcQvFlcO3Y=; b=XPDXxknxSYui4wL/dNMby70NQLdBAJS4q3RAQ6h4pxMQkjVdtvGlBhoTCllF6xQIk5 G4Bwse/d5lxBzoqv8hzzeGfUWr9aaZ20bHHE+0lV35HvRrx+4ITxmG449oW1VA8TSSAF 8pIXZX6qyyLHwE3lKCKzoc0oyfjJGUaWmiDJMrLVltfiZZExXjZc4ddY/bSB/vgAHn5/ iFFrcOhxYz50YLhqAsU60797LLdkwhGzBtBCQXKQPc1xQlgcjCP5HkFbGprKCf16Fymj UTf9szZjlOQiUgXHcp0d3J9s9NBJ5A/w2wxZNyUrb7W6kX+UkPHSJg/DMhQI2gdaAFHk GNeA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=R4yWrQJj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y19si23053044pfo.133.2019.04.25.00.09.00; Thu, 25 Apr 2019 00:09:16 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=R4yWrQJj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732463AbfDXVKv (ORCPT + 99 others); Wed, 24 Apr 2019 17:10:51 -0400 Received: from mail-ua1-f74.google.com ([209.85.222.74]:37881 "EHLO mail-ua1-f74.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727791AbfDXVKv (ORCPT ); Wed, 24 Apr 2019 17:10:51 -0400 Received: by mail-ua1-f74.google.com with SMTP id w19so2534877uar.4 for ; Wed, 24 Apr 2019 14:10:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=EEx6KKB2U0RJZ21EFlDN1R7C1ruUVShWYlcQvFlcO3Y=; b=R4yWrQJjCJ8Bn88/SOwrmAKIiYFKv2Ld/L1gosT676YETZR3g9s1zjAw+XfRBUFxUt yYONprmgp2eEy+5GwASlKDn6gwSGZ0K3BrnVJoIFcb+QwADtHOu+KbAC7dIlloZXv2zF InmrO+sJenQD3LDR7GFPk1TMvt2RpsFfAYIYGXpWrLIKvULclDqbRCFRJwtDNItMrOI8 ImsP/SuHDwn3Z/5R6WU3lbRAI/gTXNTev2yRr3j9qut3+t+F1PFYVIGFC7djLq6dqM3f vkIjbcwDmU4DyBgpuufndPDpRyb2Mz6pZ85CKWVlgD6Y6JJtcYNhFX0c8qNlKKRe5Tbs sshw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=EEx6KKB2U0RJZ21EFlDN1R7C1ruUVShWYlcQvFlcO3Y=; b=AK8JHjIwLk0cecNegoRS85uWJuDnKOK6TaXobYtLgp/8YwFXXp2jP+9nJtfE1FMWdQ evPwMWJvL48UTB8vxcqW3bVXtbHsjhl3s9WTkPlUsA6hCeQi1UvNI8h1nmmm3jeeKa75 h7MhxNdG0yjsT8IMzyyH7anSYGivDyYG9HKCOlajebSgCjd9+mAGBdNIqVM9J/14vJ9W LzHyzGW58COPLsiWe/vb28l9k6hEOoGU3uT8Fji61Y/YOCA6G9n5OwCS17CRTq81Emeo zT5rAEo1bOUu1iXoQgpdCimaqYRjh9iA4f9wttsQ9IAVp995cfeDumswTTOcO9vNylpW fnLQ== X-Gm-Message-State: APjAAAUiZhShPsB4z9fg0MtacA9z8nQTpUURpMk3EwgxZ3HHTlLHHsUB lNF1uQJNI3A5EKuYghUNz1eUH3A0h/PYy51KphQHBA== X-Received: by 2002:a67:c895:: with SMTP id v21mr855019vsk.5.1556140249661; Wed, 24 Apr 2019 14:10:49 -0700 (PDT) Date: Wed, 24 Apr 2019 14:10:39 -0700 In-Reply-To: Message-Id: <20190424211038.204001-1-matthewgarrett@google.com> Mime-Version: 1.0 References: X-Mailer: git-send-email 2.21.0.593.g511ec345e18-goog Subject: [PATCH V2] mm: Allow userland to request that the kernel clear memory on release From: Matthew Garrett To: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, Matthew Garrett Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Matthew Garrett Applications that hold secrets and wish to avoid them leaking can use mlock() to prevent the page from being pushed out to swap and MADV_DONTDUMP to prevent it from being included in core dumps. Applications can also use atexit() handlers to overwrite secrets on application exit. However, if an attacker can reboot the system into another OS, they can dump the contents of RAM and extract secrets. We can avoid this by setting CONFIG_RESET_ATTACK_MITIGATION on UEFI systems in order to request that the firmware wipe the contents of RAM before booting another OS, but this means rebooting takes a *long* time - the expected behaviour is for a clean shutdown to remove the request after scrubbing secrets from RAM in order to avoid this. Unfortunately, if an application exits uncleanly, its secrets may still be present in RAM. This can't be easily fixed in userland (eg, if the OOM killer decides to kill a process holding secrets, we're not going to be able to avoid that), so this patch adds a new flag to madvise() to allow userland to request that the kernel clear the covered pages whenever the page reference count hits zero. Since vm_flags is already full on 32-bit, it will only work on 64-bit systems. Signed-off-by: Matthew Garrett --- Modified to wipe when the VMA is released rather than on page freeing include/linux/mm.h | 6 ++++++ include/uapi/asm-generic/mman-common.h | 2 ++ mm/madvise.c | 21 +++++++++++++++++++++ mm/memory.c | 3 +++ 4 files changed, 32 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index 6b10c21630f5..64bdab679275 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -257,6 +257,8 @@ extern unsigned int kobjsize(const void *objp); #define VM_HIGH_ARCH_2 BIT(VM_HIGH_ARCH_BIT_2) #define VM_HIGH_ARCH_3 BIT(VM_HIGH_ARCH_BIT_3) #define VM_HIGH_ARCH_4 BIT(VM_HIGH_ARCH_BIT_4) + +#define VM_WIPEONRELEASE BIT(37) /* Clear pages when releasing them */ #endif /* CONFIG_ARCH_USES_HIGH_VMA_FLAGS */ #ifdef CONFIG_ARCH_HAS_PKEYS @@ -298,6 +300,10 @@ extern unsigned int kobjsize(const void *objp); # define VM_GROWSUP VM_NONE #endif +#ifndef VM_WIPEONRELEASE +# define VM_WIPEONRELEASE VM_NONE +#endif + /* Bits set in the VMA until the stack is in its final location */ #define VM_STACK_INCOMPLETE_SETUP (VM_RAND_READ | VM_SEQ_READ) diff --git a/include/uapi/asm-generic/mman-common.h b/include/uapi/asm-generic/mman-common.h index abd238d0f7a4..82dfff4a8e3d 100644 --- a/include/uapi/asm-generic/mman-common.h +++ b/include/uapi/asm-generic/mman-common.h @@ -64,6 +64,8 @@ #define MADV_WIPEONFORK 18 /* Zero memory on fork, child only */ #define MADV_KEEPONFORK 19 /* Undo MADV_WIPEONFORK */ +#define MADV_WIPEONRELEASE 20 +#define MADV_DONTWIPEONRELEASE 21 /* compatibility flags */ #define MAP_FILE 0 diff --git a/mm/madvise.c b/mm/madvise.c index 21a7881a2db4..989c2fde15cf 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -92,6 +92,22 @@ static long madvise_behavior(struct vm_area_struct *vma, case MADV_KEEPONFORK: new_flags &= ~VM_WIPEONFORK; break; + case MADV_WIPEONRELEASE: + /* MADV_WIPEONRELEASE is only supported on anonymous memory. */ + if (VM_WIPEONRELEASE == 0 || vma->vm_file || + vma->vm_flags & VM_SHARED) { + error = -EINVAL; + goto out; + } + new_flags |= VM_WIPEONRELEASE; + break; + case MADV_DONTWIPEONRELEASE: + if (VM_WIPEONRELEASE == 0) { + error = -EINVAL; + goto out; + } + new_flags &= ~VM_WIPEONRELEASE; + break; case MADV_DONTDUMP: new_flags |= VM_DONTDUMP; break; @@ -727,6 +743,8 @@ madvise_behavior_valid(int behavior) case MADV_DODUMP: case MADV_WIPEONFORK: case MADV_KEEPONFORK: + case MADV_WIPEONRELEASE: + case MADV_DONTWIPEONRELEASE: #ifdef CONFIG_MEMORY_FAILURE case MADV_SOFT_OFFLINE: case MADV_HWPOISON: @@ -785,6 +803,9 @@ madvise_behavior_valid(int behavior) * MADV_DONTDUMP - the application wants to prevent pages in the given range * from being included in its core dump. * MADV_DODUMP - cancel MADV_DONTDUMP: no longer exclude from core dump. + * MADV_WIPEONRELEASE - clear the contents of the memory after the last + * reference to it has been released + * MADV_DONTWIPEONRELEASE - cancel MADV_WIPEONRELEASE * * return values: * zero - success diff --git a/mm/memory.c b/mm/memory.c index ab650c21bccd..ff78b527660e 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1091,6 +1091,9 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb, page_remove_rmap(page, false); if (unlikely(page_mapcount(page) < 0)) print_bad_pte(vma, addr, ptent, page); + if (unlikely(vma->vm_flags & VM_WIPEONRELEASE) && + page_mapcount(page) == 0) + clear_highpage(page); if (unlikely(__tlb_remove_page(tlb, page))) { force_flush = 1; addr += PAGE_SIZE; -- 2.21.0.593.g511ec345e18-goog