linux-kernel - Re: [PATCH] mm: don't lose the SOFT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140129204830.GB25429@gmail.com>
Date:	Thu, 30 Jan 2014 00:48:30 +0400
From:	Andrew Vagin <avagin@...il.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Andrey Vagin <avagin@...nvz.org>, x86@...nel.org,
	linux-kernel@...r.kernel.org,
	Cyrill Gorcunov <gorcunov@...nvz.org>, criu@...nvz.org,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	Pavel Emelyanov <xemul@...allels.com>,
	Borislav Petkov <bp@...e.de>,
	Wen Congyang <wency@...fujitsu.com>
Subject: Re: [PATCH] mm: don't lose the SOFT_DIRTY flag on mprotect

On Wed, Jan 29, 2014 at 12:18:59PM -0800, Andrew Morton wrote:
> On Thu, 30 Jan 2014 00:04:59 +0400 Andrey Vagin <avagin@...nvz.org> wrote:
> 
> > The SOFT_DIRTY bit shows that the content of memory was changed
> > after a defined point in the past. mprotect() doesn't change the
> > content of memory, so it must not change the SOFT_DIRTY bit.
> > 
> > This patch does nothing with _PAGE_SWP_SOFT_DIRTY, becase pte_modify()
> > is called only for present pages.
> 
> Standard complaint: when fixing a bug, please describe the end-user
> visible effects of that bug.
> 
> afaict the effects are minor: snapshotting will save/copy more pages
> than it needs to, but there will be no malfunction.  Hence a -stable
> backport is unneeded.  Agree?

There will be malfunction. On the first iteration all pages are dumped.
On other iterations only pages with the SOFT_DIRTY bit are dumped. So if
the SOFT_DIRTY bit is cleared from a page by mistake, the page is not
dumped and its content will be restored incorrectly.
This patch should be cc'ed to stable. Sorry forgot to do this in first
place.

The following program is able to detect the problem:
#include <sys/mman.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>

#define PME_SOFT_DIRTY (1ULL << 55)

int main()
{
        unsigned long long v;
        void *p;
        int fd;

        p = mmap(NULL, 4096, PROT_WRITE,
				MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
        if (p == MAP_FAILED)
                return -1;

        fd = open("/proc/self/clear_refs", O_WRONLY);
        if (fd < 0)
                return 1;
        if (write(fd, "4\n", 2) < 2)
                return 1;
        close(fd);

        *((int *) p) = 5;

        fd = open("/proc/self/pagemap", O_RDONLY);
        if (fd < 0)
                return 1;
        mprotect(p, 4096, PROT_READ);
        lseek(fd, (unsigned long) p / 4096 * 8, SEEK_SET);
        read(fd, &v, sizeof(v));
        close(fd);

        printf("%8llx\n", v);

        if (v & PME_SOFT_DIRTY) {
                printf("PASS\n");
                return 0;
        }

        printf("FAIL\n");
        return 1;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/