linux-kernel - Re: [PATCH] mm: Enable MAP_UNINITIALIZED for archs with mmu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 24 Jan 2012 12:07:04 +0900
From:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
To:	Arun Sharma <asharma@...com>
Cc:	<linux-kernel@...r.kernel.org>, <linux-mm@...ck.org>,
	Balbir Singh <bsingharora@...il.com>,
	<akpm@...ux-foundation.org>
Subject: Re: [PATCH] mm: Enable MAP_UNINITIALIZED for archs with mmu

On Mon, 23 Jan 2012 16:54:22 -0800
Arun Sharma <asharma@...com> wrote:

> On 1/18/12 6:42 PM, KAMEZAWA Hiroyuki wrote:
> >
> > Hmm, then,
> > 1. a new task jumped into this cgroup can see any uncleared data...
> > 2. if a memcg pointer is reused, the information will be leaked.
> 
> You're suggesting mm_match_cgroup() is good enough for accounting 
> purposes, but not usable for cases where its important to get the 
> equality right?
> 

I think there is no 100% solution to check reuse of object.



> > 3. If VM_UNINITALIZED is set, the process can see any data which
> >     was freed by other process which doesn't know VM_UNINITALIZED at all.
> >
> > 4. The process will be able to see file cache data which the it has no
> >     access right if it's accessed by memcg once.
> >
> > 3&  4 seems too danger.
> 
> Yes - these are the risks that I'm hoping we can document, so the 
> cgroups admin can avoid opting-in if not everything running in the 
> cgroup is trusted.
> 

I guess admins/users can't handle that.

> >
> > Isn't it better to have this as per-task rather than per-memcg ?
> > And just allow to reuse pages the page has freed ?
> >
> 
> I'm worrying that the additional complexity of maintaining a per-task 
> page list would be a problem. It might slow down workloads that 
> alloc/free a lot because of the added code. It'll probably touch the 
> kswapd as well (for reclaiming pages from the per-task free lists under 
> low mem conditions).
> 
> Did you have some implementation ideas which would not have the problems 
> above?
> 

If you just want to reduce latency of GFP_ZERO, you may be able to
clear pages by (rate limited) kernel daemon for minimize latency.

But, what I'm not sure is the effect of cpu cache. Now, user process
can expect the page is on cpu cache when it faulted. page-fault
does all prefetching by clearing pages. This helps performance much
in general. So, I think it's limited situation that no-clear-page-at-fault
is good for total applications performance.
You can see reduction of clear_page() cost by removing GFP_ZERO but
what's your application's total performance ? Is it good enough considering
many risks ?


Thanks,
-Kame










--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/