linux-kernel - Re: [PATCH 1/5] mm: Introduce mm_struct.has

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200922115436.GG8409@ziepe.ca>
Date:   Tue, 22 Sep 2020 08:54:36 -0300
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Jann Horn <jannh@...gle.com>
Cc:     Peter Xu <peterx@...hat.com>, Linux-MM <linux-mm@...ck.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Jan Kara <jack@...e.cz>, Michal Hocko <mhocko@...e.com>,
        Kirill Tkhai <ktkhai@...tuozzo.com>,
        Kirill Shutemov <kirill@...temov.name>,
        Hugh Dickins <hughd@...gle.com>,
        Christoph Hellwig <hch@....de>,
        Andrea Arcangeli <aarcange@...hat.com>,
        John Hubbard <jhubbard@...dia.com>,
        Oleg Nesterov <oleg@...hat.com>,
        Leon Romanovsky <leonro@...dia.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 1/5] mm: Introduce mm_struct.has_pinned

On Tue, Sep 22, 2020 at 12:47:11AM +0200, Jann Horn wrote:
> On Tue, Sep 22, 2020 at 12:30 AM Peter Xu <peterx@...hat.com> wrote:
> > On Mon, Sep 21, 2020 at 11:43:38PM +0200, Jann Horn wrote:
> > > On Mon, Sep 21, 2020 at 11:17 PM Peter Xu <peterx@...hat.com> wrote:
> > > > (Commit message collected from Jason Gunthorpe)
> > > >
> > > > Reduce the chance of false positive from page_maybe_dma_pinned() by keeping
> > > > track if the mm_struct has ever been used with pin_user_pages(). mm_structs
> > > > that have never been passed to pin_user_pages() cannot have a positive
> > > > page_maybe_dma_pinned() by definition.
> > >
> > > There are some caveats here, right? E.g. this isn't necessarily true
> > > for pagecache pages, I think?
> >
> > Sorry I didn't follow here.  Could you help explain with some details?
> 
> The commit message says "mm_structs that have never been passed to
> pin_user_pages() cannot have a positive page_maybe_dma_pinned() by
> definition"; but that is not true for pages which may also be mapped
> in a second mm and may have been passed to pin_user_pages() through
> that second mm (meaning they must be writable over there and not
> shared with us via CoW).

The message does need a few more words to explain this trick can only
be used with COW'able pages.
 
> Process A:
> 
> fd_a = open("/foo/bar", O_RDWR);
> mapping_a = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED, fd_a, 0);
> pin_user_pages(mapping_a, 1, ...);
> 
> Process B:
> 
> fd_b = open("/foo/bar", O_RDONLY);
> mapping_b = mmap(NULL, 0x1000, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd_b, 0);
> *(volatile char *)mapping_b;
> 
> At this point, process B has never called pin_user_pages(), but
> page_maybe_dma_pinned() on the page at mapping_b would return true.

My expectation is the pin_user_pages() should have already broken the
COW for the MAP_PRIVATE, so process B should not have a
page_maybe_dma_pinned()

Jason