linux-kernel - Re: [PATCH linux-next] mm/madvise: allow KSM hints for process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 1 Jul 2022 15:19:35 +0200
From:   Michal Hocko <mhocko@...e.com>
To:     David Hildenbrand <david@...hat.com>
Cc:     cgel.zte@...il.com, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, vbabka@...e.cz, minchan@...nel.org,
        oleksandr@...hat.com, xu xin <xu.xin16@....com.cn>,
        Jann Horn <jannh@...gle.com>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH linux-next] mm/madvise: allow KSM hints for
 process_madvise

On Fri 01-07-22 14:39:24, David Hildenbrand wrote:
> > I am not sure about exact details of the KSM implementation but if that
> > is not a desirable behavior then it should be handled on the KSM level.
> > The very sam thing can easily happen in a multithreaded (or in general
> > multi-process with shared mm) environment as well.
> 
> I don't quite get what you mean.

I meant to say that if KSM needs to be aware of a special CoW semantic
then it should be handled on the KSM layer regardless whether the KSM
has been set by the process itself or any other process that has acccess
to the MM. process_madvise is just another way to access a remote MM
other than sharing the full MM.
 
[...]
> > Are you saying that any remote handling of the KSM has to deal with a
> > pre-existing semantic as well? Are we aware of any existing application
> > that really uses MADV_UNMERGEABLE in a hope to disable KSM for any of
> > its sensitive memory ranges? My understanding is that this is simply a
> > on/off knob and a remote way to do the same is in line with the existing
> > API.
> 
> "its sensitive memory ranges" that's exactly what I am concerned of.
> There should be a toggle, and existing applciations will not be using it.

The thing is that most applications (are there any?) do not actively
say that something is not KSM safe, right? They expect they opt in where
it makes sense. So my question is, whether any remote way to opt in for
KSM has to redefine the existing semantic or the same should be achieved
by a sufficient privileges?

The former would have really hard times to be applicable to the very
likely first hand usecase - unmodifiable binaries...

> > To be completely honest I do not really buy an argument that this might
> > break something much more than the original application can do already.
> 
> How can you get a shared zeropage in a private mapping after a previous
> write if not via KSM?

I was not referring to KSM specifically here. My recollection is that
PTRACE_MODE_READ_FSCREDS is quite powerful already.
-- 
Michal Hocko
SUSE Labs