linux-kernel - Re: [PATCH linux-next] mm/madvise: allow KSM hints for process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <11d28e6d-edb0-7d11-b476-c5808f3b7c5d@redhat.com>
Date:   Fri, 1 Jul 2022 21:12:56 +0200
From:   David Hildenbrand <david@...hat.com>
To:     Michal Hocko <mhocko@...e.com>
Cc:     cgel.zte@...il.com, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, vbabka@...e.cz, minchan@...nel.org,
        oleksandr@...hat.com, xu xin <xu.xin16@....com.cn>,
        Jann Horn <jannh@...gle.com>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH linux-next] mm/madvise: allow KSM hints for
 process_madvise

On 01.07.22 15:19, Michal Hocko wrote:
> On Fri 01-07-22 14:39:24, David Hildenbrand wrote:
>>> I am not sure about exact details of the KSM implementation but if that
>>> is not a desirable behavior then it should be handled on the KSM level.
>>> The very sam thing can easily happen in a multithreaded (or in general
>>> multi-process with shared mm) environment as well.
>>
>> I don't quite get what you mean.
> 
> I meant to say that if KSM needs to be aware of a special CoW semantic
> then it should be handled on the KSM layer regardless whether the KSM
> has been set by the process itself or any other process that has acccess
> to the MM. process_madvise is just another way to access a remote MM
> other than sharing the full MM.

Okay.

KSM has been a corner case feature that was restricted to well-defined
and well-tested environments. Until recently, R/O pins of any KSM pages
was essentially completely unreliably. And applications don't expect
such surprises. The shared zeropage is most probably the last
problematic piece.

Yes, we're getting there that it's a real feature that can see more
(forced) wide-spread use. However, until the known issues in KSM have
been fixed (e.g., below -- there is a whole list of papers regarding
attacks on memory deduplication), it should be limited to well defined
environments and applications only -- IMHO.

So what I want to express here is that if we're adding an interface that
can be used to just enable KSM on the whole system easily, it might be a
bit to soon for that. No matter what you document, people will ignore it.

OTOH, if this is a real debug feature that will only be available in
specific debug/test scenarios (kernel config? toggle? whatsoever?), then
it's "better". If that is already the case, good.

>  
> [...]
>>> Are you saying that any remote handling of the KSM has to deal with a
>>> pre-existing semantic as well? Are we aware of any existing application
>>> that really uses MADV_UNMERGEABLE in a hope to disable KSM for any of
>>> its sensitive memory ranges? My understanding is that this is simply a
>>> on/off knob and a remote way to do the same is in line with the existing
>>> API.
>>
>> "its sensitive memory ranges" that's exactly what I am concerned of.
>> There should be a toggle, and existing applciations will not be using it.
> 
> The thing is that most applications (are there any?) do not actively
> say that something is not KSM safe, right? They expect they opt in where

They can't. But knowing about stuff like
https://access.redhat.com/security/cve/cve-2021-3714 makes me be sure
that there are applications that don't want this force-enabled ever.

> it makes sense. So my question is, whether any remote way to opt in for
> KSM has to redefine the existing semantic or the same should be achieved
> by a sufficient privileges?
> 
> The former would have really hard times to be applicable to the very
> likely first hand usecase - unmodifiable binaries...

Yes, I know. I also don't have a good answer to all of that.

> 
>>> To be completely honest I do not really buy an argument that this might
>>> break something much more than the original application can do already.
>>
>> How can you get a shared zeropage in a private mapping after a previous
>> write if not via KSM?
> 
> I was not referring to KSM specifically here. My recollection is that
> PTRACE_MODE_READ_FSCREDS is quite powerful already.

Ah, you mean process_madvise() permissions.

-- 
Thanks,

David / dhildenb