From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD997C18E5A for ; Tue, 10 Mar 2020 19:12:14 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 86320215A4 for ; Tue, 10 Mar 2020 19:12:14 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="J0WefFmT" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 86320215A4 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2811F6B000A; Tue, 10 Mar 2020 15:12:14 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 209236B000C; Tue, 10 Mar 2020 15:12:14 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0D0C46B000D; Tue, 10 Mar 2020 15:12:14 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0105.hostedemail.com [216.40.44.105]) by kanga.kvack.org (Postfix) with ESMTP id E32926B000A for ; Tue, 10 Mar 2020 15:12:13 -0400 (EDT) Received: from smtpin04.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 89625180AD820 for ; Tue, 10 Mar 2020 19:12:13 +0000 (UTC) X-FDA: 76580398146.04.death06_4d86c7d7ceb4f X-HE-Tag: death06_4d86c7d7ceb4f X-Filterd-Recvd-Size: 5242 Received: from mail-ot1-f52.google.com (mail-ot1-f52.google.com [209.85.210.52]) by imf06.hostedemail.com (Postfix) with ESMTP for ; Tue, 10 Mar 2020 19:12:12 +0000 (UTC) Received: by mail-ot1-f52.google.com with SMTP id h17so1860221otn.7 for ; Tue, 10 Mar 2020 12:12:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5f/ZIdPcYSXzyxew8zIk4AJ4DOH6Pen1hOIrk5wOGuM=; b=J0WefFmTNOhOFZfuP45RhnlFcgePPbh0WTKAXHMYkK6WpB792ZvmtCF0IY9fwLL+D9 JYJva+8s2L8brQt+mP0QlFI7Ubx3EtJuWV5oTHXRO+WY28LuJwAyn/8SxV+0Qyy7CD76 /aczONR6PbSmyO4Jpl0ndluwcRjeuPxynXS2PAiNIKnzmcG8zQ+rRLwuSK3v7H/42U7s 3gBiwksatm7XW6OgKd+S9mlSz2ZH4IjWEd7jU44IaTUcLYGy0AfPrWXWEqjPK8Ug+Ff/ 4HY4RTJ54vfJgBDg9xuGCcljL/Sz5iU602XYFQ1/oJw+1pqY892w0lM1AOzT3wGCOwp6 gkvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5f/ZIdPcYSXzyxew8zIk4AJ4DOH6Pen1hOIrk5wOGuM=; b=gkPYvhJwFFdIJ3fF9M/nUpJoB6aCB1Q6gnnA83iM+sBttodBZGz9wH4TLH8pKHMacP amZxrgdUkC0tG7NVJnOgkl8axKO6LSMJJRJob9mmS/DJhtM7KKxa49JhTaJA65t85GJu Q6k02fAF+f4p4t3ndPWhpZVQHgUHMxZcdZ0mR34FDSScf/mLycjpxCSg0BFtNkOjHhtL G2zhxzPXO5b6qVNKOf34YmA38HkefJdtrkVZTslK+O6KQIg1WhBU9Ok7wEAk6G29mgT4 NikvGoNJupfITmavqBNt2o4h5uH1vrTA/gPQ3OrJdLpvMbNBV3fp1wRmQU87TDdolc62 JZsQ== X-Gm-Message-State: ANhLgQ38qU26oOSX03wDSLqd6rV7oh5YOOzmetXO/vt14VMRWU8+ZHZ9 UGEaXjge9bWsSnUcgbT3lbVaPyZ5ZB3/CKPJFEH0m7eenKM= X-Google-Smtp-Source: ADFU+vtpoR0syrUpVW9+sWGjnb2mV+Evtc2BNWvaZAC67ZRm+H1x48AKs6JQmohLa3X8uvKP9YzaVUlGmxjfz8k3eXs= X-Received: by 2002:a05:6830:1d6e:: with SMTP id l14mr17635080oti.32.1583867531366; Tue, 10 Mar 2020 12:12:11 -0700 (PDT) MIME-Version: 1.0 References: <20200310184814.GA8447@dhcp22.suse.cz> In-Reply-To: <20200310184814.GA8447@dhcp22.suse.cz> From: Jann Horn Date: Tue, 10 Mar 2020 20:11:45 +0100 Message-ID: Subject: Re: interaction of MADV_PAGEOUT with CoW anonymous mappings? To: Michal Hocko Cc: Minchan Kim , Linux-MM , kernel list , Daniel Colascione , Dave Hansen , "Joel Fernandes (Google)" Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000416, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Mar 10, 2020 at 7:48 PM Michal Hocko wrote: > On Tue 10-03-20 19:08:28, Jann Horn wrote: > > Hi! > > > > >From looking at the source code, it looks to me as if using > > MADV_PAGEOUT on a CoW anonymous mapping will page out the page if > > possible, even if other processes still have the same page mapped. Is > > that correct? > > > > If so, that's probably bad in environments where many processes (with > > different privileges) are forked from a single zygote process (like > > Android and Chrome), I think? If you accidentally call it on a CoW > > anonymous mapping with shared pages, you'll degrade the performance of > > other processes. And if an attacker does it intentionally, they could > > use that to aid with exploiting race conditions or weird > > microarchitectural stuff (e.g. the new https://lviattack.eu/lvi.pdf > > talks about "the assumption that attackers can provoke page faults or > > microcode assists for (arbitrary) load operations in the victim > > domain"). > > > > Should madvise_cold_or_pageout_pte_range() maybe refuse to operate on > > pages with mapcount>1, or something like that? Or does it already do > > that, and I just missed the check? > > I have brought up side channel attacks earlier [1] but only in the > context of shared page cache pages. I didn't really consider shared > anonymous pages to be a real problem. I was under impression that CoW > pages shouldn't be a real problem because any security sensible > applications shouldn't allow untrusted code to be forked and CoW > anything really important. I believe we have made this assumption > in other places - IIRC on gup with FOLL_FORCE but I admit I have > very happily forgot most details. Android has a "zygote" process that starts up the whole Java environment with a bunch of libraries before entering into a loop that fork()s off a child every time the user wants to launch an app. So all the apps, and even browser renderer processes, on the device share many CoW VMAs. See . I think Chrome on Linux desktop systems also forks off renderers from a common zygote process after initializing libraries and so on. See . (But they use a relatively strict seccomp sandbox that e.g. doesn't permit MADV_PAGEOUT.)