linux-kernel - Re: Debugging COW (copy on write) memory after fork: Is it possible to dump only the private anonymous memory of a process?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <516274B7.4050002@biovista.com>
Date:	Mon, 08 Apr 2013 10:41:43 +0300
From:	Vassilis Virvilis <v.virvilis@...vista.com>
To:	Bruno Prémont <bonbons@...ux-vserver.org>
CC:	linux-kernel@...r.kernel.org
Subject: Re: Debugging COW (copy on write) memory after fork: Is it possible
 to dump only the private anonymous memory of a process?

On 04/06/2013 09:11 PM, Bruno Prémont wrote:
> On Fri, 05 April 2013 Vassilis Virvilis<v.virvilis@...vista.com>  wrote:
>>
>> Question
>> --------
>>
>> Is it possible to dump only the private anonymous memory of a process?
>
> I don't know if that's possible, but from your background you could
> probably work around it be mmap()ing the memory you need and once
> initialized mark all of that memory read-only (if you mmap very large
> chunks you can even benefit from huge-pages).
>
> Any of the forked processes that tried to access the memory would then
> get a signal if they ever tried to write to the data (and thus unsharing it)
>

I can't do that. We are talking about an existing system (in perl with C 
modules) that has been parallelized in a second step.

> If you allocate and initialize all of your memory in little malloc()'ed
> chunks it's possibly glibc's memory housekeeping that unshares all those
> pages over time.

Yes I suppose it is a series of mallocs. I could easily verify that with 
strace. However if glibc's memory housekeeping undermines the COW 
behaviour that would be very bad.

I have unit tests that I was able to work around the usual perl problems 
that cause memory unsharing such as the reference counting and hash 
accessing. Garbage collector shouldn't be a problem because there is 
nothing to collect from the shared memory, only private local variables 
that go out of scope. The problem is when I am employing these 
workarounds in the live system (with considerable IO) I am getting 
massive unsharing. So I thought to have a look and see what's going in 
two or three consecutive private memory dumps.

The point is I need to locate the source of the memory unsharing. Any 
ideas how this can be done?

At this point I could try in house compiled kernels if I can enable some 
logging to track this behavior. Does any knob like this exist? Even as 
an #ifdef?

	Vassilis
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/