linux-kernel - Re: [bug report] mm/hugetlb: possible data leak with huge pmd sharing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2ec4cd05-5b3a-cd5c-7785-5a7236804bef@huawei.com>
Date:   Tue, 26 Jul 2022 15:14:17 +0800
From:   Miaohe Lin <linmiaohe@...wei.com>
To:     Mike Kravetz <mike.kravetz@...cle.com>
CC:     Linux-MM <linux-mm@...ck.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Muchun Song <songmuchun@...edance.com>
Subject: Re: [bug report] mm/hugetlb: possible data leak with huge pmd sharing

On 2022/7/26 2:35, Mike Kravetz wrote:
> On 07/25/22 17:07, Miaohe Lin wrote:
>> Hi all:
>>     When I investigate the mm/hugetlb code, I found there's a possible data leak issue
>> with huge pmd sharing. Thank about the below scene:
>>
>>     1. Process A and process B shares huge pmd page.(vm_flags: VM_MAYSHARE but !VM_SHARED)
> 
> Thanks,
> 
> I often get confused about the setting of VM_MAYSHARE and VM_SHARED.  When
> you throw in the possibility of shared and anonymous, then I struggle a bit
> more.  At one time did an audit to get the meaning clear in my mind, but still
> struggle with the meanings.
> 
> Is it possible to have VM_MAYSHARE and !VM_SHARED on a hugetlb vma?  I only
> took a quick look and could not find a way for this to happen.  But, I> could have easily missed something.

Thanks for your reply. It's possible to have VM_MAYSHARE and !VM_SHARED on a hugetlb vma
with below code snippet:

...
    fd = open("/root/huge/hugepagefile", O_CREAT | O_RDONLY, 0755);
    if (fd < 0) {
            perror("Open failed");
            exit(1);
    }

    addr = mmap(0, 32UL*1024*1024, PROT_READ, MAP_SHARED, fd, 0);
...

cat /proc/<pid>/smaps:

400000000000-400002000000 r--s 00000000 00:2f 153780886                  /root/huge/hugepagefile
Size:              32768 kB
KernelPageSize:     2048 kB
MMUPageSize:        2048 kB
...
VmFlags: rd mr me ms de ht

/* sh: VM_SHARED, mw: VM_MAYWRITE, ms:VM_MAYSHARE */

So vm_flags is VM_MAYSHARE but !VM_SHARED.

But in this case, it's readonly. So the above scene won't happen. Sorry for make noise.

> 

Thanks for your comment again. :)