linux-kernel - Re: [PATCH v4 1/3] PM / Hibernate: prepare for SANITIZE_FREED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <555C73E7.23237.269170A5@pageexec.freemail.hu>
Date:	Wed, 20 May 2015 13:45:43 +0200
From:	"PaX Team" <pageexec@...email.hu>
To:	Anisse Astier <anisse@...ier.eu>,
	"Rafael J. Wysocki" <rjw@...ysocki.net>
CC:	Andrew Morton <akpm@...ux-foundation.org>,
	Mel Gorman <mgorman@...e.de>,
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
	David Rientjes <rientjes@...gle.com>,
	Alan Cox <gnomes@...rguk.ukuu.org.uk>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Brad Spengler <spender@...ecurity.net>,
	Kees Cook <keescook@...omium.org>,
	Andi Kleen <andi@...stfloor.org>, Pavel Machek <pavel@....cz>,
	Len Brown <len.brown@...el.com>, linux-mm@...ck.org,
	Linux PM list <linux-pm@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4 1/3] PM / Hibernate: prepare for SANITIZE_FREED_PAGES

On 20 May 2015 at 1:46, Rafael J. Wysocki wrote:

> swsusp_free() is *the* function that, well, frees all the pages allocated
> by the hibernate core, so how isn't the free pages bitmap valid when it is
> called?
> 
> Why don't you add the clearing in there, right at the spot when the pages
> are actually freed?

actually swsusp_free uses __free_page which in turn will go through the
page sanitization logic so there's no need for extra sanitization. that
said ...

> Moreover, why is the resume code path the only one where freed pages need to
> be sanitized? 

... i had a bug report before (http://marc.info/?l=linux-pm&m=132871433416256)
which is why i asked Anisse to figure this out before upstreaming the feature.
i've also asked him already to explain why his approach is the proper fix for
the problem (which should include the description of the root cause as a start)
but he hasn't answered that yet.

anyway, the big question is how there can be free memory pages after resume
which are not sanitized. now i have no idea about the hibernation logic but
i assume that it doesn't save/restore free pages so the question is how the
kernel gets to learn about these free pages during resume and whether there's
a path where __free_page() or some other wrapper around free_pages_prepare()
doesn't get called at all.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/