Received: by 2002:a25:4158:0:0:0:0:0 with SMTP id o85csp282565yba; Mon, 20 May 2019 08:37:56 -0700 (PDT) X-Google-Smtp-Source: APXvYqw+qS7tl6mrlZRkppZb672cyla9oUNz8zPPKmISLo6n93/kqmAfyZnZoWATCLMEuDENjFlS X-Received: by 2002:a63:2bd1:: with SMTP id r200mr13657403pgr.202.1558366676424; Mon, 20 May 2019 08:37:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1558366676; cv=none; d=google.com; s=arc-20160816; b=rPqyzinnG+2uhj4fRZ8B0qyHyzZ6oUSnzIGMbND3beFc/EH7C+YUon031WX+exZFYn lbL4eVj1w+2q4aPeT4u4btvO4QLa/1Se8rdNutwUhAZtY1D5Ga8uek9kiynYsnASl90G jmZ/58dCDEnaNPuBv5yc+UrIolp/Ogv7awebQFxK5ZyLUdvV70QxBGSoUgvMor53VcEA K5oTLTmjAcEFpWgGtEjt+qr9aWb9AwrQ9ILmHqtHQn7sNybjs1REWBRRQ3upciemFvwv sTbcaa7GdJGnoEwFrtYWhbUkGPzBQH70QntMBAdI5YD+Fm8Zvir9BVeHX7bX9TqnO8gZ u/Ww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=CCv+PrlvxyYrWPKP3AC9sdm9ccZmc/r0qxypHm0tsno=; b=dKIlrT07xN/KmqgniMyHP9dOdm1mmxFNeizr6peyHw1AP7yIJ8Mtd74upHNd+bsfiS aDNZ7OowfyyjbkJN/rEMZCKhxTCWCeWGOhEl41AK7YQi1jq+m9ReOklSn/IKhZb8dVjI 3Zp4EJx99BPox3c9/H1L29iMXqUPph+kreLIJk8vttufoUKqvMvTRt0qk/BZwMsBvgmQ ulMoEBgz/ifZMRvzOX+TVbpUtPpSgWGCzHY5p0CVnKYU9PJjx1zTJ4w+XpN/dNYlixu4 irECDbi6NxFHjmw0Pe0++7/TUS6+9s/LQwuIc5A8xX/CUzZSvREDsS3rEYNsfwzz6RXI cnxA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=RTKZRRg1; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h19si18352125pgg.125.2019.05.20.08.37.40; Mon, 20 May 2019 08:37:56 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=RTKZRRg1; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388529AbfETMXJ (ORCPT + 99 others); Mon, 20 May 2019 08:23:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:37256 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388519AbfETMXE (ORCPT ); Mon, 20 May 2019 08:23:04 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C2B3B21019; Mon, 20 May 2019 12:23:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1558354983; bh=FnOiAWCxbxKZVe4E+ZcIN19Am0EYnQ0noptC7Y+yIqM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RTKZRRg1YHRvm7rV96wwn8ua+v79ABSZwNwDNGswW5qYEpHLD1q+7ERv+4+QMTLnQ MewUZbuSENBKo4MC9Ob9ehMzOOX33ohmCLgSnN85DG+SEmfFnd5kk3VUiMnJHHGQ2w 1AsOBNXXemOo5W/v/1reE4NWzt41nTE2zpzPSeOQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Kosina , Vlastimil Babka , Josh Snyder , Michal Hocko , Andy Lutomirski , Dave Chinner , Kevin Easton , Matthew Wilcox , Cyril Hrubis , Tejun Heo , "Kirill A. Shutemov" , Daniel Gruss , Andrew Morton , Linus Torvalds , Dominique Martinet Subject: [PATCH 4.19 053/105] mm/mincore.c: make mincore() more conservative Date: Mon, 20 May 2019 14:13:59 +0200 Message-Id: <20190520115250.721190520@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190520115247.060821231@linuxfoundation.org> References: <20190520115247.060821231@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jiri Kosina commit 134fca9063ad4851de767d1768180e5dede9a881 upstream. The semantics of what mincore() considers to be resident is not completely clear, but Linux has always (since 2.3.52, which is when mincore() was initially done) treated it as "page is available in page cache". That's potentially a problem, as that [in]directly exposes meta-information about pagecache / memory mapping state even about memory not strictly belonging to the process executing the syscall, opening possibilities for sidechannel attacks. Change the semantics of mincore() so that it only reveals pagecache information for non-anonymous mappings that belog to files that the calling process could (if it tried to) successfully open for writing; otherwise we'd be including shared non-exclusive mappings, which - is the sidechannel - is not the usecase for mincore(), as that's primarily used for data, not (shared) text [jkosina@suse.cz: v2] Link: http://lkml.kernel.org/r/20190312141708.6652-2-vbabka@suse.cz [mhocko@suse.com: restructure can_do_mincore() conditions] Link: http://lkml.kernel.org/r/nycvar.YFH.7.76.1903062342020.19912@cbobk.fhfr.pm Signed-off-by: Jiri Kosina Signed-off-by: Vlastimil Babka Acked-by: Josh Snyder Acked-by: Michal Hocko Originally-by: Linus Torvalds Originally-by: Dominique Martinet Cc: Andy Lutomirski Cc: Dave Chinner Cc: Kevin Easton Cc: Matthew Wilcox Cc: Cyril Hrubis Cc: Tejun Heo Cc: Kirill A. Shutemov Cc: Daniel Gruss Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/mincore.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) --- a/mm/mincore.c +++ b/mm/mincore.c @@ -169,6 +169,22 @@ out: return 0; } +static inline bool can_do_mincore(struct vm_area_struct *vma) +{ + if (vma_is_anonymous(vma)) + return true; + if (!vma->vm_file) + return false; + /* + * Reveal pagecache information only for non-anonymous mappings that + * correspond to the files the calling process could (if tried) open + * for writing; otherwise we'd be including shared non-exclusive + * mappings, which opens a side channel. + */ + return inode_owner_or_capable(file_inode(vma->vm_file)) || + inode_permission(file_inode(vma->vm_file), MAY_WRITE) == 0; +} + /* * Do a chunk of "sys_mincore()". We've already checked * all the arguments, we hold the mmap semaphore: we should @@ -189,8 +205,13 @@ static long do_mincore(unsigned long add vma = find_vma(current->mm, addr); if (!vma || addr < vma->vm_start) return -ENOMEM; - mincore_walk.mm = vma->vm_mm; end = min(vma->vm_end, addr + (pages << PAGE_SHIFT)); + if (!can_do_mincore(vma)) { + unsigned long pages = DIV_ROUND_UP(end - addr, PAGE_SIZE); + memset(vec, 1, pages); + return pages; + } + mincore_walk.mm = vma->vm_mm; err = walk_page_range(addr, end, &mincore_walk); if (err < 0) return err;