linux-kernel - Re: [PATCH] userfaultfd: Write protect when virtual memory range has no page table entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210323151238.GD6486@xz-x1>
Date:   Tue, 23 Mar 2021 11:12:38 -0400
From:   Peter Xu <peterx@...hat.com>
To:     Bui Quang Minh <minhquangbui99@...il.com>
Cc:     Mike Rapoport <rppt@...nel.org>, Michal Hocko <mhocko@...e.com>,
        akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        Andrea Arcangeli <aarcange@...hat.com>
Subject: Re: [PATCH] userfaultfd: Write protect when virtual memory range has
 no page table entry

On Tue, Mar 23, 2021 at 09:48:03AM +0700, Bui Quang Minh wrote:
> On Mon, Mar 22, 2021 at 03:00:37PM +0200, Mike Rapoport wrote:
> > On Mon, Mar 22, 2021 at 11:14:37AM +0100, Michal Hocko wrote:
> > > Le'ts Andrea and Mike
> > > 
> > > On Fri 19-03-21 22:24:28, Bui Quang Minh wrote:
> > > > userfaultfd_writeprotect() use change_protection() to clear write bit in
> > > > page table entries (pte/pmd). So, later write to this virtual address
> > > > range causes a page fault, which is then handled by userspace program.
> > > > However, change_protection() has no effect when there is no page table
> > > > entries associated with that virtual memory range (a newly mapped memory
> > > > range). As a result, later access to that memory range causes allocating a
> > > > page table entry with write bit still set (due to VM_WRITE flag in
> > > > vma->vm_flags).
> > > > 
> > > > Add checks for VM_UFFD_WP in vma->vm_flags when allocating new page table
> > > > entry in missing page table entry page fault path.
> > > 
> > > From the above it is not really clear whether this is a usability
> > > problem or a bug of the interface.
> > 
> > I'd say it's usability/documentation clarity issue. 
> > Userspace can register an area with
> > 
> > 	UFFDIO_REGISTER_MODE_MISSING | UFFDIO_REGISTER_MODE_WP
> > 
> > and then it will be notified either when page table has no entry for a
> > virtual address or when there is a write to a write protected address.
> 
> Yes, you are right. I saw a patch from Peter to linux-man and saw that
> 
> 	"When there is only UFFDIO_REGISTER_MODE_WP registered, the userspace
> 	will not receive any message when a missing page is written"
> 
> It's my mistake that I didn't look at the documentation carefully when playing
> around.

If there's a mistake, it's me forgetting to write the document when the feature
landed.. :)

But still I think you raised a good point, and I was also serious when
proposing that UFFD_FEATURE_WP_UNALLOCATED idea, since indeed we had similar
issue as QEMU live snapshot e.g. when the guest enabled kernel init_on_free,
meanwhile virtio-balloon could have recycled the same zero page, then that zero
page could got replaced with some garbage page when saving the snapshot, while
we expect it to come back as strictly a zero page, since when the guest OS
reuse this page it'll skip zeroing it assuming it's a zero page.

QEMU plans to fix it using pre-faults as UFFDIO_COPY will complicate the live
snapshot framework, but UFFD_FEATURE_WP_UNALLOCATED should be more efficient.
It's just that we still needs to keep the old behavior.

I'll see whether I can prepare a patch for it shortly, with some test case too.

Thanks,

-- 
Peter Xu