linux-kernel - Re: [PATCH 4.4 18/58] mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <6478C2F6-1841-4C54-AD1A-A2CFC134D31F@gmail.com>
Date:   Tue, 15 Aug 2017 09:39:45 -0700
From:   Nadav Amit <nadav.amit@...il.com>
To:     Ben Hutchings <ben.hutchings@...ethink.co.uk>,
        Mel Gorman <mgorman@...e.de>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        stable@...r.kernel.org, Andy Lutomirski <luto@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH 4.4 18/58] mm, mprotect: flush TLB if potentially racing
 with a parallel reclaim leaving stale TLB entries

Ben Hutchings <ben.hutchings@...ethink.co.uk> wrote:

> On Sat, 2017-08-12 at 23:27 -0700, Nadav Amit wrote:
>> Ben Hutchings <ben.hutchings@...ethink.co.uk> wrote:
>> 
>>> On Wed, 2017-08-09 at 12:41 -0700, Greg Kroah-Hartman wrote:
>>>> 4.4-stable review patch.  If anyone has any objections, please let me know.
>>>> 
>>>> ------------------
>>>> 
>>>> From: Mel Gorman <mgorman@...e.de>
>>>> 
>>>> commit 3ea277194daaeaa84ce75180ec7c7a2075027a68 upstream.
>>> [...]
>>>> +/*
>>>> + * Reclaim unmaps pages under the PTL but do not flush the TLB prior to
>>>> + * releasing the PTL if TLB flushes are batched. It's possible for a parallel
>>>> + * operation such as mprotect or munmap to race between reclaim unmapping
>>>> + * the page and flushing the page. If this race occurs, it potentially allows
>>>> + * access to data via a stale TLB entry. Tracking all mm's that have TLB
>>>> + * batching in flight would be expensive during reclaim so instead track
>>>> + * whether TLB batching occurred in the past and if so then do a flush here
>>>> + * if required. This will cost one additional flush per reclaim cycle paid
>>>> + * by the first operation at risk such as mprotect and mumap.
>>>> + *
>>>> + * This must be called under the PTL so that an access to tlb_flush_batched
>>>> + * that is potentially a "reclaim vs mprotect/munmap/etc" race will synchronise
>>>> + * via the PTL.
>>> 
>>> What about USE_SPLIT_PTE_PTLOCKS?  I don't see how you can use "the PTL"
>>> to synchronise access to a per-mm flag.
>> 
>> Although it is a per-mm flag, the only situations we care about it are those
>> in which “the PTL” (i.e. the same PTL) is accessed by both the reclaimer
>> (which batches the flushes) and mprotect/munmap/etc.
> 
> Is there anything that presents this sequence?
> 
> P0                              P1                             P2
> --                              --                             --
> 
> change_pte_range() [ptl=X]
> -> flush_tlb_batch_pending()
>   -> flush_tlb_mm()
>                                try_to_unmap_one() [ptl=Y]
>                                -> set_tlb_ubc_flush_pending()
>                                   -> tlb_flush_batched = true
>   -> tlb_flush_batched = false
> 
> change_pte_range() [ptl=Y]
>                                                               ->
> flush_tlb_batch_pending()
>                                                                  (nop)

I think (but not sure) that you regard a similar concern I raised before.
Mel gave an answer [1], but I cannot say I feel very comfortable with it.

[1] http://www.spinics.net/lists/linux-mm/msg131265.html

Nadav