lkml.org 
[lkml]   [2022]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [bug report] mm/hugetlb: possible data leak with huge pmd sharing
From
Date
On 2022/7/26 2:35, Mike Kravetz wrote:
> On 07/25/22 17:07, Miaohe Lin wrote:
>> Hi all:
>> When I investigate the mm/hugetlb code, I found there's a possible data leak issue
>> with huge pmd sharing. Thank about the below scene:
>>
>> 1. Process A and process B shares huge pmd page.(vm_flags: VM_MAYSHARE but !VM_SHARED)
>
> Thanks,
>
> I often get confused about the setting of VM_MAYSHARE and VM_SHARED. When
> you throw in the possibility of shared and anonymous, then I struggle a bit
> more. At one time did an audit to get the meaning clear in my mind, but still
> struggle with the meanings.
>
> Is it possible to have VM_MAYSHARE and !VM_SHARED on a hugetlb vma? I only
> took a quick look and could not find a way for this to happen. But, I> could have easily missed something.

Thanks for your reply. It's possible to have VM_MAYSHARE and !VM_SHARED on a hugetlb vma
with below code snippet:

...
fd = open("/root/huge/hugepagefile", O_CREAT | O_RDONLY, 0755);
if (fd < 0) {
perror("Open failed");
exit(1);
}

addr = mmap(0, 32UL*1024*1024, PROT_READ, MAP_SHARED, fd, 0);
...

cat /proc/<pid>/smaps:

400000000000-400002000000 r--s 00000000 00:2f 153780886 /root/huge/hugepagefile
Size: 32768 kB
KernelPageSize: 2048 kB
MMUPageSize: 2048 kB
...
VmFlags: rd mr me ms de ht

/* sh: VM_SHARED, mw: VM_MAYWRITE, ms:VM_MAYSHARE */

So vm_flags is VM_MAYSHARE but !VM_SHARED.

But in this case, it's readonly. So the above scene won't happen. Sorry for make noise.

>

Thanks for your comment again. :)

\
 
 \ /
  Last update: 2022-07-26 09:15    [W:0.167 / U:0.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site