linux-kernel - Re: Flushing whole page instead of work for ptrace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101203150021.GA11114@redhat.com>
Date:	Fri, 3 Dec 2010 16:00:21 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Roland McGrath <roland@...hat.com>
Cc:	michal.simek@...alogix.com,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>, linux-mm@...ck.org,
	John Williams <john.williams@...alogix.com>,
	"Edgar E. Iglesias" <edgar.iglesias@...il.com>
Subject: Re: Flushing whole page instead of work for ptrace

On 11/30, Roland McGrath wrote:
>
> Documentation/cachetlb.txt says:
>
> 	Any time the kernel writes to a page cache page, _OR_
> 	the kernel is about to read from a page cache page and
> 	user space shared/writable mappings of this page potentially
> 	exist, this routine is called.
>
> In your case, the kernel is only reading (write=0 passed to
> access_process_vm and get_user_pages).  In normal situations,
> the page in question will have only a private and read-only
> mapping in user space.  So the call should not be required in
> these cases--if the code can tell that's so.
>
> Perhaps something like the following would be safe.
> But you really need some VM folks to tell you for sure.
>
> diff --git a/mm/memory.c b/mm/memory.c
> index 02e48aa..2864ee7 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1484,7 +1484,8 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
>  				pages[i] = page;
>
>  				flush_anon_page(vma, page, start);
> -				flush_dcache_page(page);
> +				if ((vm_flags & VM_WRITE) || (vma->vm_flags & VM_SHARED)
> +					flush_dcache_page(page);

First of all, I know absolutely nothing about D-cache aliasing.
My poor understanding of flush_dcache_page() is: synchronize the
kernel/user vision of this memory, in the case when either side
can change it.

If this is true, then this change doesn't look right in general.

Even if (vma->vm_flags & VM_SHARED) == 0, it is possible that
tsk can write to this memory, this mapping can be writable and
private.

Even if we ensure that this mapping is readonly/private, another
user-space process can write to this page via shared/writable
mapping.


I'd like to know if my understanding is correct, I am just curious.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/