Re: [PATCH] hibernate: unlock swap bdev for writing when uswsusp is active

From: "Rafael J. Wysocki" <rafael@kernel.org>
To: Domenico Andreoli <domenico.andreoli@linux.com>
Cc: "Darrick J. Wong" <darrick.wong@oracle.com>,
	Linux PM <linux-pm@vger.kernel.org>,
	 Linux Memory Management List <linux-mm@kvack.org>,
	linux-fsdevel@vger.kernel.org, mkleinsoft@gmail.com,
	 Christoph Hellwig <hch@lst.de>,
	Andrew Morton <akpm@linux-foundation.org>,
	 "Rafael J. Wysocki" <rjw@rjwysocki.net>,
	Len Brown <len.brown@intel.com>, Pavel Machek <pavel@ucw.cz>
Subject: Re: [PATCH] hibernate: unlock swap bdev for writing when uswsusp is active
Date: Sun, 1 Mar 2020 22:35:36 +0100	[thread overview]
Message-ID: <CAJZ5v0iHaZyfuTnqJyM6u=UU=+W6yRuM_Q6iUvB2UudANuwfgA@mail.gmail.com> (raw)
In-Reply-To: <20200229200200.GA10970@dumbo>

On Sat, Feb 29, 2020 at 9:02 PM Domenico Andreoli
<domenico.andreoli@linux.com> wrote:
>
> On Sat, Feb 29, 2020 at 10:38:20AM -0800, Darrick J. Wong wrote:
> > On Sat, Feb 29, 2020 at 07:07:16PM +0100, Domenico Andreoli wrote:
> > > On Sat, Feb 29, 2020 at 09:08:25AM -0800, Darrick J. Wong wrote:
> > > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > > >
> > > > It turns out that there /is/ one use case for programs being able to
> > > > write to swap devices, and that is the userspace hibernation code.  The
> > > > uswsusp ioctls allow userspace to lease parts of swap devices, so turn
> > > > S_SWAPFILE off when invoking suspend.
> > > >
> > > > Fixes: 1638045c3677 ("mm: set S_SWAPFILE on blockdev swap devices")
> > > > Reported-by: Domenico Andreoli <domenico.andreoli@linux.com>
> > > > Reported-by: Marian Klein <mkleinsoft@gmail.com>
> > >
> > > I also tested it yesterday but was not satisfied, unfortunately I did
> > > not come with my comment in time.
> > >
> > > Yes, I confirm that the uswsusp works again but also checked that
> > > swap_relockall() is not triggered at all and therefore after the first
> > > hibernation cycle the S_SWAPFILE bit remains cleared and the whole
> > > swap_relockall() is useless.
> > >
> > > I'm not sure this patch should be merged in the current form.
> >
> > NNGGHHGGHGH /me is rapidly losing his sanity and will soon just revert
> > the whole security feature because I'm getting fed up with people
> > yelling at me *while I'm on vacation* trying to *restore* my sanity.  I
> > really don't want to be QAing userspace-directed hibernation right now.
>
> Maybe we could proceed with the first patch to amend the regression and
> postpone the improved fix to a later patch? Don't loose sanity for this.

I would concur here.

> > ...right, the patch is broken because we have to relock the swapfiles in
> > whatever code executes after we jump back to the restored kernel, not in
> > the one that's doing the restoring.  Does this help?
>
> I made a few unsuccessful attempts in kernel/power/hibernate.c and
> eventually I'm switching to qemu to speed up the test cycle.
>
> > OTOH, maybe we should just leave the swapfiles unlocked after resume.
> > Userspace has clearly demonstrated the one usecase for writing to the
> > swapfile, which means anyone could have jumped in while uswsusp was
> > running and written whatever crap they wanted to the parts of the swap
> > file that weren't leased for the hibernate image.
>
> Essentially, if the hibernation is supported the swapfile is not totally
> safe.

But that's only the case with the userspace variant, isn't it?

> Maybe user-space hibernation should be a separate option.

That actually is not a bad idea at all in my view.

Thanks!