linux-kernel - Re: [PATCH RFC] mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y5D0HsBAfQiswoKV@x1n>
Date:   Wed, 7 Dec 2022 15:14:22 -0500
From:   Peter Xu <peterx@...hat.com>
To:     David Hildenbrand <david@...hat.com>
Cc:     Hugh Dickins <hughd@...gle.com>, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, Ives van Hoorne <ives@...esandbox.io>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Alistair Popple <apopple@...dia.com>,
        Mike Rapoport <rppt@...ux.vnet.ibm.com>,
        Nadav Amit <nadav.amit@...il.com>,
        Andrea Arcangeli <aarcange@...hat.com>
Subject: Re: [PATCH RFC] mm/userfaultfd: enable writenotify while
 userfaultfd-wp is enabled for a VMA

On Wed, Dec 07, 2022 at 08:53:36PM +0100, David Hildenbrand wrote:
> Once user space successfully placed an uffd-wp marker, and e.g., verified
> using pagemap that it is indeed placed, the system should not silently drop
> it.

Note that the anon path doesn't use pte markers.  We won't lose a pte
marker, hopefully, if we do that's a more severe one.

> 
> The behavior between an ordinary THP and a huge zeropage differs. For THP,
> we handle the split correctly and don't lose the marker. Assuming the huge
> zeropage woud be disabled, the behavior would be (IMHO) correct. The test
> case would pass.
> 
> For example, QEMU with uffd-wp based snapshotting will make sure that all
> virtual addresses are populated (e.g., mapping the shared, eventually the
> huge zeropage -- populate_read_range()), before protecting using uffd-wp.
> Losing a uffd-wp marker would be problematic.
> 
> The good news is that we barely will end up PTE-mapping the huge zeropage
> unless there is real user-space interaction (mprotect(), mremap(), mmap()),
> so this shouldn't trigger in the QEMU use-case.

Ah yes, I forgot that part.  If it's not affected then it's better.

> 
> 
> Anyhow, I'll send a patch in a couple of days and we can discuss further.
> It's independent of the other discussion, just wanted to report my findings
> after staring at that code for way too long today.

Thanks, that works for me.

-- 
Peter Xu