[PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Huang, Ying]

From: Huang Ying <ying.huang@intel.com>

The swap offset reported by /proc/<pid>/pagemap may be not correct for
PMD migration entry.  If addr passed into pagemap_range() isn't
aligned with PMD start address, the swap offset reported doesn't
reflect this.  And in the loop to report information of each sub-page,
the swap offset isn't increased accordingly as that for PFN.

BTW: migration swap entries have PFN information, do we need to
restrict whether to show them?

Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Andrei Vagin <avagin@openvz.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: "Jerome Glisse" <jglisse@redhat.com>
Cc: Daniel Colascione <dancol@google.com>
Cc: Zi Yan <zi.yan@cs.rutgers.edu>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
---
 fs/proc/task_mmu.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 65ae54659833..757e748da613 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1310,9 +1310,11 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
 		else if (is_swap_pmd(pmd)) {
 			swp_entry_t entry = pmd_to_swp_entry(pmd);
+			unsigned long offset = swp_offset(entry);
 
+			offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
 			frame = swp_type(entry) |
-				(swp_offset(entry) << MAX_SWAPFILES_SHIFT);
+				(offset << MAX_SWAPFILES_SHIFT);
 			flags |= PM_SWAP;
 			if (pmd_swp_soft_dirty(pmd))
 				flags |= PM_SOFT_DIRTY;
@@ -1332,6 +1334,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
 				break;
 			if (pm->show_pfn && (flags & PM_PRESENT))
 				frame++;
+			else if (flags | PM_SWAP)
+				frame += (1 << MAX_SWAPFILES_SHIFT);
 		}
 		spin_unlock(ptl);
 		return err;
-- 
2.15.1

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Andrew Morton]

On Sun,  8 Apr 2018 11:37:37 +0800 "Huang, Ying" <ying.huang@intel.com> wrote:

> From: Huang Ying <ying.huang@intel.com>
> 
> The swap offset reported by /proc/<pid>/pagemap may be not correct for
> PMD migration entry.  If addr passed into pagemap_range() isn't

pagemap_pmd_range(), yes?

> aligned with PMD start address,

How can this situation come about?

> the swap offset reported doesn't
> reflect this.  And in the loop to report information of each sub-page,
> the swap offset isn't increased accordingly as that for PFN.
> 
> BTW: migration swap entries have PFN information, do we need to
> restrict whether to show them?

For what reason?  Address obfuscation?

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Huang, Ying]

Andrew Morton <akpm@linux-foundation.org> writes:

> On Sun,  8 Apr 2018 11:37:37 +0800 "Huang, Ying" <ying.huang@intel.com> wrote:
>
>> From: Huang Ying <ying.huang@intel.com>
>> 
>> The swap offset reported by /proc/<pid>/pagemap may be not correct for
>> PMD migration entry.  If addr passed into pagemap_range() isn't
>
> pagemap_pmd_range(), yes?

Yes.  Sorry for typo.

>> aligned with PMD start address,
>
> How can this situation come about?

After open /proc/<pid>/pagemap, if user seeks to a page whose address
doesn't aligned with PMD start address.  I have verified this with a
simple test program.

>> the swap offset reported doesn't
>> reflect this.  And in the loop to report information of each sub-page,
>> the swap offset isn't increased accordingly as that for PFN.
>> 
>> BTW: migration swap entries have PFN information, do we need to
>> restrict whether to show them?
>
> For what reason?  Address obfuscation?

This is an existing feature for PFN report of /proc/<pid>/pagemap,
reason is in following commit log.  I am wondering whether that is
necessary for migration swap entries too.

ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
Author:     Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
AuthorDate: Mon Mar 9 23:11:12 2015 +0200
Commit:     Linus Torvalds <torvalds@linux-foundation.org>
CommitDate: Tue Mar 17 09:31:30 2015 -0700

pagemap: do not leak physical addresses to non-privileged userspace

As pointed by recent post[1] on exploiting DRAM physical imperfection,
/proc/PID/pagemap exposes sensitive information which can be used to do
attacks.

This disallows anybody without CAP_SYS_ADMIN to read the pagemap.

[1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html

[ Eventually we might want to do anything more finegrained, but for now
  this is the simple model.   - Linus ]

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Acked-by: Andy Lutomirski <luto@amacapital.net>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Seaborn <mseaborn@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Best Regards,
Huang, Ying

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Huang, Ying]

Andrew Morton <akpm@linux-foundation.org> writes:

> On Sun,  8 Apr 2018 11:37:37 +0800 "Huang, Ying" <ying.huang@intel.com> wrote:
>
>> From: Huang Ying <ying.huang@intel.com>
>> 
>> The swap offset reported by /proc/<pid>/pagemap may be not correct for
>> PMD migration entry.  If addr passed into pagemap_range() isn't
>
> pagemap_pmd_range(), yes?

Yes.  Sorry for typo.

>> aligned with PMD start address,
>
> How can this situation come about?

After open /proc/<pid>/pagemap, if user seeks to a page whose address
doesn't aligned with PMD start address.  I have verified this with a
simple test program.

>> the swap offset reported doesn't
>> reflect this.  And in the loop to report information of each sub-page,
>> the swap offset isn't increased accordingly as that for PFN.
>> 
>> BTW: migration swap entries have PFN information, do we need to
>> restrict whether to show them?
>
> For what reason?  Address obfuscation?

This is an existing feature for PFN report of /proc/<pid>/pagemap,
reason is in following commit log.  I am wondering whether that is
necessary for migration swap entries too.

ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
Author:     Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
AuthorDate: Mon Mar 9 23:11:12 2015 +0200
Commit:     Linus Torvalds <torvalds@linux-foundation.org>
CommitDate: Tue Mar 17 09:31:30 2015 -0700

pagemap: do not leak physical addresses to non-privileged userspace

As pointed by recent post[1] on exploiting DRAM physical imperfection,
/proc/PID/pagemap exposes sensitive information which can be used to do
attacks.

This disallows anybody without CAP_SYS_ADMIN to read the pagemap.

[1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html

[ Eventually we might want to do anything more finegrained, but for now
  this is the simple model.   - Linus ]

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Acked-by: Andy Lutomirski <luto@amacapital.net>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Seaborn <mseaborn@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Best Regards,
Huang, Ying

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Huang, Ying]

Hi, Andrew,

"Huang, Ying" <ying.huang@intel.com> writes:

> From: Huang Ying <ying.huang@intel.com>
>
> The swap offset reported by /proc/<pid>/pagemap may be not correct for
> PMD migration entry.  If addr passed into pagemap_range() isn't
> aligned with PMD start address, the swap offset reported doesn't
> reflect this.  And in the loop to report information of each sub-page,
> the swap offset isn't increased accordingly as that for PFN.
>
> BTW: migration swap entries have PFN information, do we need to
> restrict whether to show them?
>
> Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
> Cc: Andrei Vagin <avagin@openvz.org>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: "Jerome Glisse" <jglisse@redhat.com>
> Cc: Daniel Colascione <dancol@google.com>
> Cc: Zi Yan <zi.yan@cs.rutgers.edu>
> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> ---
>  fs/proc/task_mmu.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 65ae54659833..757e748da613 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -1310,9 +1310,11 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
>  #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
>  		else if (is_swap_pmd(pmd)) {
>  			swp_entry_t entry = pmd_to_swp_entry(pmd);
> +			unsigned long offset = swp_offset(entry);
>  
> +			offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
>  			frame = swp_type(entry) |
> -				(swp_offset(entry) << MAX_SWAPFILES_SHIFT);
> +				(offset << MAX_SWAPFILES_SHIFT);
>  			flags |= PM_SWAP;
>  			if (pmd_swp_soft_dirty(pmd))
>  				flags |= PM_SOFT_DIRTY;
> @@ -1332,6 +1334,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
>  				break;
>  			if (pm->show_pfn && (flags & PM_PRESENT))
>  				frame++;
> +			else if (flags | PM_SWAP)

Oops, I just found a typo here, it should be,

+			else if (flags & PM_SWAP)

Sorry about that.  Do I need to refresh the patch or you will fix it
inline?

Best Regards,
Huang, Ying

> +				frame += (1 << MAX_SWAPFILES_SHIFT);
>  		}
>  		spin_unlock(ptl);
>  		return err;

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Huang, Ying]

Hi, Andrew,

"Huang, Ying" <ying.huang@intel.com> writes:

> From: Huang Ying <ying.huang@intel.com>
>
> The swap offset reported by /proc/<pid>/pagemap may be not correct for
> PMD migration entry.  If addr passed into pagemap_range() isn't
> aligned with PMD start address, the swap offset reported doesn't
> reflect this.  And in the loop to report information of each sub-page,
> the swap offset isn't increased accordingly as that for PFN.
>
> BTW: migration swap entries have PFN information, do we need to
> restrict whether to show them?
>
> Signed-off-by: "Huang, Ying" <ying.huang@intel.com>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
> Cc: Andrei Vagin <avagin@openvz.org>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: "Jerome Glisse" <jglisse@redhat.com>
> Cc: Daniel Colascione <dancol@google.com>
> Cc: Zi Yan <zi.yan@cs.rutgers.edu>
> Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
> ---
>  fs/proc/task_mmu.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 65ae54659833..757e748da613 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -1310,9 +1310,11 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
>  #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
>  		else if (is_swap_pmd(pmd)) {
>  			swp_entry_t entry = pmd_to_swp_entry(pmd);
> +			unsigned long offset = swp_offset(entry);
>  
> +			offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
>  			frame = swp_type(entry) |
> -				(swp_offset(entry) << MAX_SWAPFILES_SHIFT);
> +				(offset << MAX_SWAPFILES_SHIFT);
>  			flags |= PM_SWAP;
>  			if (pmd_swp_soft_dirty(pmd))
>  				flags |= PM_SOFT_DIRTY;
> @@ -1332,6 +1334,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
>  				break;
>  			if (pm->show_pfn && (flags & PM_PRESENT))
>  				frame++;
> +			else if (flags | PM_SWAP)

Oops, I just found a typo here, it should be,

+			else if (flags & PM_SWAP)

Sorry about that.  Do I need to refresh the patch or you will fix it
inline?

Best Regards,
Huang, Ying

> +				frame += (1 << MAX_SWAPFILES_SHIFT);
>  		}
>  		spin_unlock(ptl);
>  		return err;

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Kirill A. Shutemov]

On Tue, Apr 10, 2018 at 08:57:19AM +0800, Huang, Ying wrote:
> >> the swap offset reported doesn't
> >> reflect this.  And in the loop to report information of each sub-page,
> >> the swap offset isn't increased accordingly as that for PFN.
> >> 
> >> BTW: migration swap entries have PFN information, do we need to
> >> restrict whether to show them?
> >
> > For what reason?  Address obfuscation?
> 
> This is an existing feature for PFN report of /proc/<pid>/pagemap,
> reason is in following commit log.  I am wondering whether that is
> necessary for migration swap entries too.
> 
> ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
> Author:     Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> AuthorDate: Mon Mar 9 23:11:12 2015 +0200
> Commit:     Linus Torvalds <torvalds@linux-foundation.org>
> CommitDate: Tue Mar 17 09:31:30 2015 -0700
> 
> pagemap: do not leak physical addresses to non-privileged userspace
> 
> As pointed by recent post[1] on exploiting DRAM physical imperfection,
> /proc/PID/pagemap exposes sensitive information which can be used to do
> attacks.
> 
> This disallows anybody without CAP_SYS_ADMIN to read the pagemap.
> 
> [1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
> 
> [ Eventually we might want to do anything more finegrained, but for now
>   this is the simple model.   - Linus ]

Note that there's follow up to the commit: 

1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users")

It introduces pm->show_pfn and it should be applied to swap entries too.

-- 
 Kirill A. Shutemov

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Huang, Ying]

"Kirill A. Shutemov" <kirill@shutemov.name> writes:

> On Tue, Apr 10, 2018 at 08:57:19AM +0800, Huang, Ying wrote:
>> >> the swap offset reported doesn't
>> >> reflect this.  And in the loop to report information of each sub-page,
>> >> the swap offset isn't increased accordingly as that for PFN.
>> >> 
>> >> BTW: migration swap entries have PFN information, do we need to
>> >> restrict whether to show them?
>> >
>> > For what reason?  Address obfuscation?
>> 
>> This is an existing feature for PFN report of /proc/<pid>/pagemap,
>> reason is in following commit log.  I am wondering whether that is
>> necessary for migration swap entries too.
>> 
>> ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
>> Author:     Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
>> AuthorDate: Mon Mar 9 23:11:12 2015 +0200
>> Commit:     Linus Torvalds <torvalds@linux-foundation.org>
>> CommitDate: Tue Mar 17 09:31:30 2015 -0700
>> 
>> pagemap: do not leak physical addresses to non-privileged userspace
>> 
>> As pointed by recent post[1] on exploiting DRAM physical imperfection,
>> /proc/PID/pagemap exposes sensitive information which can be used to do
>> attacks.
>> 
>> This disallows anybody without CAP_SYS_ADMIN to read the pagemap.
>> 
>> [1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
>> 
>> [ Eventually we might want to do anything more finegrained, but for now
>>   this is the simple model.   - Linus ]
>
> Note that there's follow up to the commit: 
>
> 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users")
>
> It introduces pm->show_pfn and it should be applied to swap entries too.

So you think we should hide all swap entry information if
(!pm->show_pfn) regardless they are migration swap entries or not?

Best Regards,
Huang, Ying

Re: [PATCH -mm] mm, pagemap: Fix swap offset value for PMD migration entry

[Huang, Ying]

"Kirill A. Shutemov" <kirill@shutemov.name> writes:

> On Tue, Apr 10, 2018 at 08:57:19AM +0800, Huang, Ying wrote:
>> >> the swap offset reported doesn't
>> >> reflect this.  And in the loop to report information of each sub-page,
>> >> the swap offset isn't increased accordingly as that for PFN.
>> >> 
>> >> BTW: migration swap entries have PFN information, do we need to
>> >> restrict whether to show them?
>> >
>> > For what reason?  Address obfuscation?
>> 
>> This is an existing feature for PFN report of /proc/<pid>/pagemap,
>> reason is in following commit log.  I am wondering whether that is
>> necessary for migration swap entries too.
>> 
>> ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
>> Author:     Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
>> AuthorDate: Mon Mar 9 23:11:12 2015 +0200
>> Commit:     Linus Torvalds <torvalds@linux-foundation.org>
>> CommitDate: Tue Mar 17 09:31:30 2015 -0700
>> 
>> pagemap: do not leak physical addresses to non-privileged userspace
>> 
>> As pointed by recent post[1] on exploiting DRAM physical imperfection,
>> /proc/PID/pagemap exposes sensitive information which can be used to do
>> attacks.
>> 
>> This disallows anybody without CAP_SYS_ADMIN to read the pagemap.
>> 
>> [1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
>> 
>> [ Eventually we might want to do anything more finegrained, but for now
>>   this is the simple model.   - Linus ]
>
> Note that there's follow up to the commit: 
>
> 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users")
>
> It introduces pm->show_pfn and it should be applied to swap entries too.

So you think we should hide all swap entry information if
(!pm->show_pfn) regardless they are migration swap entries or not?

Best Regards,
Huang, Ying