From: David Hildenbrand <david@redhat.com> To: linux-kernel@vger.kernel.org Cc: David Hildenbrand <david@redhat.com>, Andrew Morton <akpm@linux-foundation.org>, "Michael S. Tsirkin" <mst@redhat.com>, Jason Wang <jasowang@redhat.com>, Alexey Dobriyan <adobriyan@gmail.com>, Mike Rapoport <rppt@kernel.org>, "Matthew Wilcox (Oracle)" <willy@infradead.org>, Oscar Salvador <osalvador@suse.de>, Michal Hocko <mhocko@suse.com>, Roman Gushchin <guro@fb.com>, Alex Shi <alex.shi@linux.alibaba.com>, Steven Price <steven.price@arm.com>, Mike Kravetz <mike.kravetz@oracle.com>, Aili Yao <yaoaili@kingsoft.com>, Jiri Bohac <jbohac@suse.cz>, "K. Y. Srinivasan" <kys@microsoft.com>, Haiyang Zhang <haiyangz@microsoft.com>, Stephen Hemminger <sthemmin@microsoft.com>, Wei Liu <wei.liu@kernel.org>, Naoya Horiguchi <naoya.horiguchi@nec.com>, linux-hyperv@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH v3 0/6] fs/proc/kcore: don't read offline sections, logically offline pages and hwpoisoned pages Date: Wed, 26 May 2021 11:30:35 +0200 [thread overview] Message-ID: <20210526093041.8800-1-david@redhat.com> (raw) Looking for places where the kernel might unconditionally read PageOffline() pages, I stumbled over /proc/kcore; turns out /proc/kcore needs some more love to not touch some other pages we really don't want to read -- i.e., hwpoisoned ones. Examples for PageOffline() pages are pages inflated in a balloon, memory unplugged via virtio-mem, and partially-present sections in memory added by the Hyper-V balloon. When reading pages inflated in a balloon, we essentially produce unnecessary load in the hypervisor; holes in partially present sections in case of Hyper-V are not accessible and already were a problem for /proc/vmcore, fixed in makedumpfile by detecting PageOffline() pages. In the future, virtio-mem might disallow reading unplugged memory -- marked as PageOffline() -- in some environments, resulting in undefined behavior when accessed; therefore, I'm trying to identify and rework all these (corner) cases. With this series, there is really only access via /dev/mem, /proc/vmcore and kdb left after I ripped out /dev/kmem. kdb is an advanced corner-case use case -- we won't care for now if someone explicitly tries to do nasty things by reading from/writing to physical addresses we better not touch. /dev/mem is a use case we won't support for virtio-mem, at least for now, so we'll simply disallow mapping any virtio-mem memory via /dev/mem next. /proc/vmcore is really only a problem when dumping the old kernel via something that's not makedumpfile (read: basically never), however, we'll try sanitizing that as well in the second kernel in the future. Tested via kcore_dump: https://github.com/schlafwandler/kcore_dump v2 -> v3: - "mm: introduce page_offline_(begin|end|freeze|thaw) to synchronize setting PageOffline()" -- Rephrased a comment as suggested by Mike - Collected acks and rbs v1 -> v2: - Dropped "mm: rename and move page_is_poisoned()" - "fs/proc/kcore: don't read offline sections, logically offline pages ..." -- Add is_page_hwpoison() in page-flags.h along with a comment - "mm: introduce page_offline_(begin|end|freeze|thaw) to ..." -- s/unfreeze/thaw/ -- Add a comment to PageOffline documentation in page-flags.h - "virtio-mem: use page_offline_(start|end) when setting PageOffline()" -- Extend patch description - "fs/proc/kcore: use page_offline_(freeze|thaw)" -- Simplify freeze/thaw logic - Collected acks/rbs Cc: Andrew Morton <akpm@linux-foundation.org> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Michal Hocko <mhocko@suse.com> Cc: Roman Gushchin <guro@fb.com> Cc: Alex Shi <alex.shi@linux.alibaba.com> Cc: Steven Price <steven.price@arm.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Aili Yao <yaoaili@kingsoft.com> Cc: Jiri Bohac <jbohac@suse.cz> Cc: "K. Y. Srinivasan" <kys@microsoft.com> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Stephen Hemminger <sthemmin@microsoft.com> Cc: Wei Liu <wei.liu@kernel.org> Cc: Naoya Horiguchi <naoya.horiguchi@nec.com> Cc: linux-hyperv@vger.kernel.org Cc: virtualization@lists.linux-foundation.org Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org David Hildenbrand (6): fs/proc/kcore: drop KCORE_REMAP and KCORE_OTHER fs/proc/kcore: pfn_is_ram check only applies to KCORE_RAM fs/proc/kcore: don't read offline sections, logically offline pages and hwpoisoned pages mm: introduce page_offline_(begin|end|freeze|thaw) to synchronize setting PageOffline() virtio-mem: use page_offline_(start|end) when setting PageOffline() fs/proc/kcore: use page_offline_(freeze|thaw) drivers/virtio/virtio_mem.c | 2 ++ fs/proc/kcore.c | 67 ++++++++++++++++++++++++++++++------- include/linux/kcore.h | 3 -- include/linux/page-flags.h | 22 ++++++++++++ mm/util.c | 40 ++++++++++++++++++++++ 5 files changed, 118 insertions(+), 16 deletions(-) base-commit: 6efb943b8616ec53a5e444193dccf1af9ad627b5 -- 2.31.1
WARNING: multiple messages have this Message-ID (diff)
From: David Hildenbrand <david@redhat.com> To: linux-kernel@vger.kernel.org Cc: Aili Yao <yaoaili@kingsoft.com>, Michal Hocko <mhocko@suse.com>, "Michael S. Tsirkin" <mst@redhat.com>, linux-hyperv@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-mm@kvack.org, Wei Liu <wei.liu@kernel.org>, Alex Shi <alex.shi@linux.alibaba.com>, Stephen Hemminger <sthemmin@microsoft.com>, "Matthew Wilcox \(Oracle\)" <willy@infradead.org>, Steven Price <steven.price@arm.com>, Alexey Dobriyan <adobriyan@gmail.com>, Jiri Bohac <jbohac@suse.cz>, Haiyang Zhang <haiyangz@microsoft.com>, Oscar Salvador <osalvador@suse.de>, Naoya Horiguchi <naoya.horiguchi@nec.com>, linux-fsdevel@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>, Roman Gushchin <guro@fb.com>, Mike Rapoport <rppt@kernel.org>, Mike Kravetz <mike.kravetz@oracle.com> Subject: [PATCH v3 0/6] fs/proc/kcore: don't read offline sections, logically offline pages and hwpoisoned pages Date: Wed, 26 May 2021 11:30:35 +0200 [thread overview] Message-ID: <20210526093041.8800-1-david@redhat.com> (raw) Looking for places where the kernel might unconditionally read PageOffline() pages, I stumbled over /proc/kcore; turns out /proc/kcore needs some more love to not touch some other pages we really don't want to read -- i.e., hwpoisoned ones. Examples for PageOffline() pages are pages inflated in a balloon, memory unplugged via virtio-mem, and partially-present sections in memory added by the Hyper-V balloon. When reading pages inflated in a balloon, we essentially produce unnecessary load in the hypervisor; holes in partially present sections in case of Hyper-V are not accessible and already were a problem for /proc/vmcore, fixed in makedumpfile by detecting PageOffline() pages. In the future, virtio-mem might disallow reading unplugged memory -- marked as PageOffline() -- in some environments, resulting in undefined behavior when accessed; therefore, I'm trying to identify and rework all these (corner) cases. With this series, there is really only access via /dev/mem, /proc/vmcore and kdb left after I ripped out /dev/kmem. kdb is an advanced corner-case use case -- we won't care for now if someone explicitly tries to do nasty things by reading from/writing to physical addresses we better not touch. /dev/mem is a use case we won't support for virtio-mem, at least for now, so we'll simply disallow mapping any virtio-mem memory via /dev/mem next. /proc/vmcore is really only a problem when dumping the old kernel via something that's not makedumpfile (read: basically never), however, we'll try sanitizing that as well in the second kernel in the future. Tested via kcore_dump: https://github.com/schlafwandler/kcore_dump v2 -> v3: - "mm: introduce page_offline_(begin|end|freeze|thaw) to synchronize setting PageOffline()" -- Rephrased a comment as suggested by Mike - Collected acks and rbs v1 -> v2: - Dropped "mm: rename and move page_is_poisoned()" - "fs/proc/kcore: don't read offline sections, logically offline pages ..." -- Add is_page_hwpoison() in page-flags.h along with a comment - "mm: introduce page_offline_(begin|end|freeze|thaw) to ..." -- s/unfreeze/thaw/ -- Add a comment to PageOffline documentation in page-flags.h - "virtio-mem: use page_offline_(start|end) when setting PageOffline()" -- Extend patch description - "fs/proc/kcore: use page_offline_(freeze|thaw)" -- Simplify freeze/thaw logic - Collected acks/rbs Cc: Andrew Morton <akpm@linux-foundation.org> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Michal Hocko <mhocko@suse.com> Cc: Roman Gushchin <guro@fb.com> Cc: Alex Shi <alex.shi@linux.alibaba.com> Cc: Steven Price <steven.price@arm.com> Cc: Mike Kravetz <mike.kravetz@oracle.com> Cc: Aili Yao <yaoaili@kingsoft.com> Cc: Jiri Bohac <jbohac@suse.cz> Cc: "K. Y. Srinivasan" <kys@microsoft.com> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Stephen Hemminger <sthemmin@microsoft.com> Cc: Wei Liu <wei.liu@kernel.org> Cc: Naoya Horiguchi <naoya.horiguchi@nec.com> Cc: linux-hyperv@vger.kernel.org Cc: virtualization@lists.linux-foundation.org Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org David Hildenbrand (6): fs/proc/kcore: drop KCORE_REMAP and KCORE_OTHER fs/proc/kcore: pfn_is_ram check only applies to KCORE_RAM fs/proc/kcore: don't read offline sections, logically offline pages and hwpoisoned pages mm: introduce page_offline_(begin|end|freeze|thaw) to synchronize setting PageOffline() virtio-mem: use page_offline_(start|end) when setting PageOffline() fs/proc/kcore: use page_offline_(freeze|thaw) drivers/virtio/virtio_mem.c | 2 ++ fs/proc/kcore.c | 67 ++++++++++++++++++++++++++++++------- include/linux/kcore.h | 3 -- include/linux/page-flags.h | 22 ++++++++++++ mm/util.c | 40 ++++++++++++++++++++++ 5 files changed, 118 insertions(+), 16 deletions(-) base-commit: 6efb943b8616ec53a5e444193dccf1af9ad627b5 -- 2.31.1 _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
next reply other threads:[~2021-05-26 9:31 UTC|newest] Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-05-26 9:30 David Hildenbrand [this message] 2021-05-26 9:30 ` [PATCH v3 0/6] fs/proc/kcore: don't read offline sections, logically offline pages and hwpoisoned pages David Hildenbrand 2021-05-26 9:30 ` [PATCH v3 1/6] fs/proc/kcore: drop KCORE_REMAP and KCORE_OTHER David Hildenbrand 2021-05-26 9:30 ` David Hildenbrand 2021-05-26 9:30 ` [PATCH v3 2/6] fs/proc/kcore: pfn_is_ram check only applies to KCORE_RAM David Hildenbrand 2021-05-26 9:30 ` David Hildenbrand 2021-05-26 9:30 ` [PATCH v3 3/6] fs/proc/kcore: don't read offline sections, logically offline pages and hwpoisoned pages David Hildenbrand 2021-05-26 9:30 ` David Hildenbrand 2021-05-26 9:30 ` [PATCH v3 4/6] mm: introduce page_offline_(begin|end|freeze|thaw) to synchronize setting PageOffline() David Hildenbrand 2021-05-26 9:30 ` David Hildenbrand 2021-05-26 9:30 ` [PATCH v3 5/6] virtio-mem: use page_offline_(start|end) when " David Hildenbrand 2021-05-26 9:30 ` David Hildenbrand 2021-05-26 9:30 ` [PATCH v3 6/6] fs/proc/kcore: use page_offline_(freeze|thaw) David Hildenbrand 2021-05-26 9:30 ` David Hildenbrand
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210526093041.8800-1-david@redhat.com \ --to=david@redhat.com \ --cc=adobriyan@gmail.com \ --cc=akpm@linux-foundation.org \ --cc=alex.shi@linux.alibaba.com \ --cc=guro@fb.com \ --cc=haiyangz@microsoft.com \ --cc=jasowang@redhat.com \ --cc=jbohac@suse.cz \ --cc=kys@microsoft.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-hyperv@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mhocko@suse.com \ --cc=mike.kravetz@oracle.com \ --cc=mst@redhat.com \ --cc=naoya.horiguchi@nec.com \ --cc=osalvador@suse.de \ --cc=rppt@kernel.org \ --cc=steven.price@arm.com \ --cc=sthemmin@microsoft.com \ --cc=virtualization@lists.linux-foundation.org \ --cc=wei.liu@kernel.org \ --cc=willy@infradead.org \ --cc=yaoaili@kingsoft.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.