| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CADyq12z+VCyx3ibBfrN-xveHgXQf4PbVRrVb_Ui_EE5y7qk+gw@mail.gmail.com>
Date: Thu, 22 Jul 2021 11:58:42 -0400
From: Brian Geffon <bgeffon@...gle.com>
To: Dmitry Safonov <dima@...sta.com>
Cc: LKML <linux-kernel@...r.kernel.org>,
Dmitry Safonov <0x7f454c46@...il.com>,
Alexander Viro <viro@...iv.linux.org.uk>,
Andrew Morton <akpm@...ux-foundation.org>,
Andy Lutomirski <luto@...nel.org>,
Catalin Marinas <catalin.marinas@....com>,
Chen Wandun <chenwandun@...wei.com>,
Dan Carpenter <dan.carpenter@...cle.com>,
Dan Williams <dan.j.williams@...el.com>,
Dave Jiang <dave.jiang@...el.com>,
Hugh Dickins <hughd@...gle.com>,
Ingo Molnar <mingo@...hat.com>, Jason Gunthorpe <jgg@...pe.ca>,
John Hubbard <jhubbard@...dia.com>,
Kefeng Wang <wangkefeng.wang@...wei.com>,
"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
Mike Kravetz <mike.kravetz@...cle.com>,
Minchan Kim <minchan@...nel.org>,
Ralph Campbell <rcampbell@...dia.com>,
Russell King <linux@...linux.org.uk>,
Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
Thomas Gleixner <tglx@...utronix.de>,
Vishal Verma <vishal.l.verma@...el.com>,
Vlastimil Babka <vbabka@...e.cz>,
Wei Yongjun <weiyongjun1@...wei.com>,
Will Deacon <will@...nel.org>
Subject: Re: [PATCH v2] mm/mremap: Don't account pages in vma_to_resize()
On Wed, Jul 21, 2021 at 9:13 AM Dmitry Safonov <dima@...sta.com> wrote:
>
> All this vm_unacct_memory(charged) dance seems to complicate the life
> without a good reason. Furthermore, it seems not always done right on
> error-pathes in mremap_to().
> And worse than that: this `charged' difference is sometimes
> double-accounted for growing MREMAP_DONTUNMAP mremap()s in move_vma():
> : if (security_vm_enough_memory_mm(mm, new_len >> PAGE_SHIFT))
>
> Let's not do this.
> Account memory in mremap() fast-path for growing VMAs or in move_vma()
> for actually moving things. The same simpler way as it's done by
> vm_stat_account(), but with a difference to call
> security_vm_enough_memory_mm() before copying/adjusting VMA.
>
> Originally noticed by Chen Wandun:
> https://lkml.kernel.org/r/20210717101942.120607-1-chenwandun@huawei.com
>
> Cc: Alexander Viro <viro@...iv.linux.org.uk>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Cc: Andy Lutomirski <luto@...nel.org>
> Cc: Brian Geffon <bgeffon@...gle.com>
> Cc: Catalin Marinas <catalin.marinas@....com>
> Cc: Chen Wandun <chenwandun@...wei.com>
> Cc: Dan Carpenter <dan.carpenter@...cle.com>
> Cc: Dan Williams <dan.j.williams@...el.com>
> Cc: Dave Jiang <dave.jiang@...el.com>
> Cc: Hugh Dickins <hughd@...gle.com>
> Cc: Ingo Molnar <mingo@...hat.com>
> Cc: Jason Gunthorpe <jgg@...pe.ca>
> Cc: John Hubbard <jhubbard@...dia.com>
> Cc: Kefeng Wang <wangkefeng.wang@...wei.com>
> Cc: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
> Cc: Mike Kravetz <mike.kravetz@...cle.com>
> Cc: Minchan Kim <minchan@...nel.org>
> Cc: Ralph Campbell <rcampbell@...dia.com>
> Cc: Russell King <linux@...linux.org.uk>
> Cc: Thomas Bogendoerfer <tsbogend@...ha.franken.de>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Vishal Verma <vishal.l.verma@...el.com>
> Cc: Vlastimil Babka <vbabka@...e.cz>
> Cc: Wei Yongjun <weiyongjun1@...wei.com>
> Cc: Will Deacon <will@...nel.org>
> Fixes: e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")
> Signed-off-by: Dmitry Safonov <dima@...sta.com>
> ---
> mm/mremap.c | 50 ++++++++++++++++++++++----------------------------
> 1 file changed, 22 insertions(+), 28 deletions(-)
>
> diff --git a/mm/mremap.c b/mm/mremap.c
> index 5989d3990020..b90c8e732e29 100644
> --- a/mm/mremap.c
> +++ b/mm/mremap.c
> @@ -565,6 +565,7 @@ static unsigned long move_vma(struct vm_area_struct *vma,
> bool *locked, unsigned long flags,
> struct vm_userfaultfd_ctx *uf, struct list_head *uf_unmap)
> {
> + long to_account = new_len - old_len;
> struct mm_struct *mm = vma->vm_mm;
> struct vm_area_struct *new_vma;
> unsigned long vm_flags = vma->vm_flags;
> @@ -583,6 +584,9 @@ static unsigned long move_vma(struct vm_area_struct *vma,
> if (mm->map_count >= sysctl_max_map_count - 3)
> return -ENOMEM;
>
> + if (unlikely(flags & MREMAP_DONTUNMAP))
> + to_account = new_len;
> +
> if (vma->vm_ops && vma->vm_ops->may_split) {
> if (vma->vm_start != old_addr)
> err = vma->vm_ops->may_split(vma, old_addr);
> @@ -604,8 +608,8 @@ static unsigned long move_vma(struct vm_area_struct *vma,
> if (err)
> return err;
>
> - if (unlikely(flags & MREMAP_DONTUNMAP && vm_flags & VM_ACCOUNT)) {
> - if (security_vm_enough_memory_mm(mm, new_len >> PAGE_SHIFT))
> + if (vm_flags & VM_ACCOUNT) {
> + if (security_vm_enough_memory_mm(mm, to_account >> PAGE_SHIFT))
> return -ENOMEM;
> }
>
> @@ -613,8 +617,8 @@ static unsigned long move_vma(struct vm_area_struct *vma,
> new_vma = copy_vma(&vma, new_addr, new_len, new_pgoff,
> &need_rmap_locks);
> if (!new_vma) {
> - if (unlikely(flags & MREMAP_DONTUNMAP && vm_flags & VM_ACCOUNT))
> - vm_unacct_memory(new_len >> PAGE_SHIFT);
> + if (vm_flags & VM_ACCOUNT)
> + vm_unacct_memory(to_account >> PAGE_SHIFT);
> return -ENOMEM;
> }
>
> @@ -708,8 +712,7 @@ static unsigned long move_vma(struct vm_area_struct *vma,
> }
>
> static struct vm_area_struct *vma_to_resize(unsigned long addr,
> - unsigned long old_len, unsigned long new_len, unsigned long flags,
> - unsigned long *p)
> + unsigned long old_len, unsigned long new_len, unsigned long flags)
> {
> struct mm_struct *mm = current->mm;
> struct vm_area_struct *vma;
> @@ -768,13 +771,6 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
> (new_len - old_len) >> PAGE_SHIFT))
> return ERR_PTR(-ENOMEM);
>
> - if (vma->vm_flags & VM_ACCOUNT) {
> - unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
> - if (security_vm_enough_memory_mm(mm, charged))
> - return ERR_PTR(-ENOMEM);
> - *p = charged;
> - }
> -
> return vma;
> }
>
> @@ -787,7 +783,6 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
> struct mm_struct *mm = current->mm;
> struct vm_area_struct *vma;
> unsigned long ret = -EINVAL;
> - unsigned long charged = 0;
> unsigned long map_flags = 0;
>
> if (offset_in_page(new_addr))
> @@ -830,7 +825,7 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
> old_len = new_len;
> }
>
> - vma = vma_to_resize(addr, old_len, new_len, flags, &charged);
> + vma = vma_to_resize(addr, old_len, new_len, flags);
> if (IS_ERR(vma)) {
> ret = PTR_ERR(vma);
> goto out;
> @@ -853,7 +848,7 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
> ((addr - vma->vm_start) >> PAGE_SHIFT),
> map_flags);
> if (IS_ERR_VALUE(ret))
> - goto out1;
> + goto out;
>
> /* We got a new mapping */
> if (!(flags & MREMAP_FIXED))
> @@ -862,12 +857,6 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
> ret = move_vma(vma, addr, old_len, new_len, new_addr, locked, flags, uf,
> uf_unmap);
>
> - if (!(offset_in_page(ret)))
> - goto out;
> -
> -out1:
> - vm_unacct_memory(charged);
> -
> out:
> return ret;
> }
> @@ -899,7 +888,6 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
> struct mm_struct *mm = current->mm;
> struct vm_area_struct *vma;
> unsigned long ret = -EINVAL;
> - unsigned long charged = 0;
> bool locked = false;
> bool downgraded = false;
> struct vm_userfaultfd_ctx uf = NULL_VM_UFFD_CTX;
> @@ -981,7 +969,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
> /*
> * Ok, we need to grow..
> */
> - vma = vma_to_resize(addr, old_len, new_len, flags, &charged);
> + vma = vma_to_resize(addr, old_len, new_len, flags);
> if (IS_ERR(vma)) {
> ret = PTR_ERR(vma);
> goto out;
> @@ -992,10 +980,18 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
> if (old_len == vma->vm_end - addr) {
> /* can we just expand the current mapping? */
> if (vma_expandable(vma, new_len - old_len)) {
> - int pages = (new_len - old_len) >> PAGE_SHIFT;
> + long pages = (new_len - old_len) >> PAGE_SHIFT;
> +
> + if (vma->vm_flags & VM_ACCOUNT) {
> + if (security_vm_enough_memory_mm(mm, pages)) {
> + ret = -ENOMEM;
> + goto out;
> + }
> + }
Wasn't this whole check already performed in vma_to_resize()?
>
> if (vma_adjust(vma, vma->vm_start, addr + new_len,
> vma->vm_pgoff, NULL)) {
> + vm_unacct_memory(pages);
> ret = -ENOMEM;
> goto out;
> }
> @@ -1034,10 +1030,8 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
> &locked, flags, &uf, &uf_unmap);
> }
> out:
> - if (offset_in_page(ret)) {
> - vm_unacct_memory(charged);
> + if (offset_in_page(ret))
> locked = false;
> - }
> if (downgraded)
> mmap_read_unlock(current->mm);
> else
> --
> 2.32.0
>
Powered by blists - more mailing lists