From: Michal Hocko <mhocko@kernel.org>
To: Li Xinhai <lixinhai.lxh@gmail.com>
Cc: akpm <akpm@linux-foundation.org>,
"linux-mm@kvack.org" <linux-mm@kvack.org>
Subject: Re: [PATCH 0/3] mm: Fix misuse of parent anon_vma in dup_mmap path
Date: Mon, 20 Apr 2020 14:06:45 +0200 [thread overview]
Message-ID: <20200420120628.GN27314@dhcp22.suse.cz> (raw)
In-Reply-To: <2020021010155155113445@gmail.com>
On Mon 10-02-20 10:15:53, Li Xinhai wrote:
[...]
> >What are the runtime effects of this bug? How is the bug triggered?
>
> Effects of the first one is that causes ramp code to check both parent and
> child's page table, although a page couldn't be mapped by both parent
> and child, because child vma has WIPEONFORK so all pages mapped by child
> are 'new' and not relevant to parent.
>
> Effects of the second one is that the relationship of anon_vma of parent and
> child are totally convoluted. It would cause 'son', 'grandson', ..., etc, to share
> 'parent' anon_vma, which disobey the design rule of reusing anon_vma (the
> rule to be followed is that reusing should among vma of same process, and
> vma should not gone through fork).
>
> So, both issues should cause unnecessary rmap walking and have unexpected
> complexity.
>
> These two issues would not be directly visible, I used debugging code to check
> the anon_vma pointers of parent and child when inspecting the suspicious
> implementation of issue #2, then find the problem.
I am still not completely clear on the user effect. Does this allow an
adversary to generate too long anon_vma chains that wouldn't normally
happen or some other nasties that would make backporting to older
kernels really necessary? Because from my current understanding it would
only make WIPEONFORK vmas rmap walks less efficient. Or is there any
other functional issue?
--
Michal Hocko
SUSE Labs
next prev parent reply other threads:[~2020-04-20 12:06 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-08 8:35 [PATCH 0/3] mm: Fix misuse of parent anon_vma in dup_mmap path Li Xinhai
2020-02-08 8:35 ` [PATCH 1/3] mm: don't prepare anon_vma if vma has VM_WIPEONFORK Li Xinhai
2020-02-08 8:53 ` Li Xinhai
2020-04-02 13:45 ` Kirill A. Shutemov
2020-02-08 8:35 ` [PATCH 2/3] Revert "mm/rmap.c: reuse mergeable anon_vma as parent when fork" Li Xinhai
2020-04-02 13:59 ` Kirill A. Shutemov
2020-04-03 3:08 ` Li Xinhai
2020-04-05 1:26 ` Li Xinhai
2020-02-08 8:35 ` [PATCH 3/3] mm: set vm_next and vm_prev to NULL in vm_area_dup() Li Xinhai
2020-04-02 14:07 ` Kirill A. Shutemov
2020-02-10 0:52 ` [PATCH 0/3] mm: Fix misuse of parent anon_vma in dup_mmap path Andrew Morton
2020-02-10 2:15 ` Li Xinhai
2020-04-20 12:06 ` Michal Hocko [this message]
2020-04-21 3:53 ` Li Xinhai
2020-04-21 7:26 ` Michal Hocko
2020-04-02 1:25 ` Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200420120628.GN27314@dhcp22.suse.cz \
--to=mhocko@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=linux-mm@kvack.org \
--cc=lixinhai.lxh@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).