lkml.org 
[lkml]   [2019]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/3] mm/mincore: make mincore() more conservative
    Date
    From: Jiri Kosina <jkosina@suse.cz>

    The semantics of what mincore() considers to be resident is not completely
    clear, but Linux has always (since 2.3.52, which is when mincore() was
    initially done) treated it as "page is available in page cache".

    That's potentially a problem, as that [in]directly exposes meta-information
    about pagecache / memory mapping state even about memory not strictly belonging
    to the process executing the syscall, opening possibilities for sidechannel
    attacks.

    Change the semantics of mincore() so that it only reveals pagecache information
    for non-anonymous mappings that belog to files that the calling process could
    (if it tried to) successfully open for writing.

    Originally-by: Linus Torvalds <torvalds@linux-foundation.org>
    Originally-by: Dominique Martinet <asmadeus@codewreck.org>
    Cc: Dominique Martinet <asmadeus@codewreck.org>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Dave Chinner <david@fromorbit.com>
    Cc: Kevin Easton <kevin@guarana.org>
    Cc: Matthew Wilcox <willy@infradead.org>
    Cc: Cyril Hrubis <chrubis@suse.cz>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Kirill A. Shutemov <kirill@shutemov.name>
    Cc: Daniel Gruss <daniel@gruss.cc>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
    ---
    mm/mincore.c | 15 ++++++++++++++-
    1 file changed, 14 insertions(+), 1 deletion(-)

    diff --git a/mm/mincore.c b/mm/mincore.c
    index 218099b5ed31..747a4907a3ac 100644
    --- a/mm/mincore.c
    +++ b/mm/mincore.c
    @@ -169,6 +169,14 @@ static int mincore_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
    return 0;
    }

    +static inline bool can_do_mincore(struct vm_area_struct *vma)
    +{
    + return vma_is_anonymous(vma) ||
    + (vma->vm_file &&
    + (inode_owner_or_capable(file_inode(vma->vm_file))
    + || inode_permission(file_inode(vma->vm_file), MAY_WRITE) == 0));
    +}
    +
    /*
    * Do a chunk of "sys_mincore()". We've already checked
    * all the arguments, we hold the mmap semaphore: we should
    @@ -189,8 +197,13 @@ static long do_mincore(unsigned long addr, unsigned long pages, unsigned char *v
    vma = find_vma(current->mm, addr);
    if (!vma || addr < vma->vm_start)
    return -ENOMEM;
    - mincore_walk.mm = vma->vm_mm;
    end = min(vma->vm_end, addr + (pages << PAGE_SHIFT));
    + if (!can_do_mincore(vma)) {
    + unsigned long pages = (end - addr) >> PAGE_SHIFT;
    + memset(vec, 1, pages);
    + return pages;
    + }
    + mincore_walk.mm = vma->vm_mm;
    err = walk_page_range(addr, end, &mincore_walk);
    if (err < 0)
    return err;
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-01-30 13:47    [W:2.475 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site