From patchwork Sat Jan 5 17:27:05 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Kosina X-Patchwork-Id: 10749313 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1F3DB13B5 for ; Sat, 5 Jan 2019 17:27:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F1BB928600 for ; Sat, 5 Jan 2019 17:27:11 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E42A228647; Sat, 5 Jan 2019 17:27:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6D3E428600 for ; Sat, 5 Jan 2019 17:27:11 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1B09F8E0122; Sat, 5 Jan 2019 12:27:10 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 1616D8E00F9; Sat, 5 Jan 2019 12:27:10 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 04FA58E0122; Sat, 5 Jan 2019 12:27:09 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-ed1-f71.google.com (mail-ed1-f71.google.com [209.85.208.71]) by kanga.kvack.org (Postfix) with ESMTP id 9C4108E00F9 for ; Sat, 5 Jan 2019 12:27:09 -0500 (EST) Received: by mail-ed1-f71.google.com with SMTP id e12so36133505edd.16 for ; Sat, 05 Jan 2019 09:27:09 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:date:from:to :cc:subject:message-id:user-agent:mime-version; bh=rbh7SbMsDzLW85qhFs/JA9KR+911TMgBdFkozzVBbtQ=; b=GncuAAb4e27vpYQ9azvC1pzOGHiVLLujXUn3rJu6Q8GZLJ5tiofH/wl6B9V4ixD7GS BVnznGt5UjASBXehl2mZAuEQNdlKpXaNX3y4Fjy7AC4BHv+lU0bdcEWYvCjumd1Asn8x 4Rjf7nvhD/GXXGZp9+ZM0XTJt2/wbpHTBzkXnV3Leunib0CgqDBl7Q1hY4tP8rqmdBJF Li1EoGSsJGt4PTaYh+ohz2BRtQYcA6cc9rdzQn32Ny/9e9bRxHb85/KIXaqQsQW402EA Bd+v7s3eW72PI8MmN8HkzohHSDekHfA4LY33bhOpHXc2/WtexiU+zVUP1rsPOtB/DRlw qnjQ== X-Original-Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning jikos@kernel.org does not designate 195.135.220.15 as permitted sender) smtp.mailfrom=jikos@kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=kernel.org X-Gm-Message-State: AA+aEWb7FJlFuQT9laCp9F1knAwMeZd7UxqxiruZuU4U/Q+vSJ5E23H6 MQEqvKq3SFmBabfEvXClpGWBrIgnakyqmf0B0XcGSzqJXy3D7Z7AP74StX6dwpH5/IlRHBdgD/7 2B+7ZxVAkvh85Qr1SofagfLfTohmee8m+ttj0fk0J43xr7vqQAKVDvSqIiqFnlo0= X-Received: by 2002:a50:cdd0:: with SMTP id h16mr51244883edj.151.1546709229113; Sat, 05 Jan 2019 09:27:09 -0800 (PST) X-Google-Smtp-Source: AFSGD/VGfy4tWzY2OOwdjU8FGMgLB/ltTX0/v1vpKF2n2GrVET4wogAzL8lfHYRPRoulxBd0OkPe X-Received: by 2002:a50:cdd0:: with SMTP id h16mr51244829edj.151.1546709227944; Sat, 05 Jan 2019 09:27:07 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1546709227; cv=none; d=google.com; s=arc-20160816; b=GSvvk45YRXuFTa5thoqZl4l30UII1LEAd4PKwL86QxxKK8p/mbLwFE59hVjRI1Robv /f2QX1loE0Z5JmM5eZtHNBsfLgaD26V1XVFXLI6kGVFpUMgAngbi00JISa0TLr5lD52U Cab6j7VLvhceyyYBkzhUxMBdcpDzzFw1HtoX9CChHZvYFlo6onCm7IfTFcd0+oaRejF7 G/d+Q5HD7Idque9dV7LbpWf3Ad5aEdfXXdlB1AAESURzOLs3aQqNAfyVGa+9OWLJ7vce Q+7HfLNHUT84QSWdotpRPvk3HS8nLTb2K+Sk2s9EaPHh3heo8QEuwrPUZsKwmU4kXp3s Q97Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:message-id:subject:cc:to:from:date; bh=rbh7SbMsDzLW85qhFs/JA9KR+911TMgBdFkozzVBbtQ=; b=DJ/OpPH4y+9jgAatsHloDgAXm3MGPtMN7YUl4QIL6+OULQMIc1WKF1yBPCJ7GrLl/a iKGAJmXTABh2lKJX01qffOdwmlatuYPFz9GqLHDhfn6i+4kCFsj4TouZiDj0IJ/CfDaz W1JOfvRLjdAPWIrYiiVqSAuBCkMupe6h9uVLFw94ybjdn0d0rWiw/j4aOaMnjOr9antW d0PoSrXKtkny8k/cMWZgazepTMugkK5ZMquI+6KTbt88hwQwIzFHVbTgP/+W/039wLzP UdVAG9l6/bltQq86WbBQJEnHmRmGnmBXjHdKS1ib5yQX072+UCSUnE0rp9wVjl+TVtGc kTTA== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning jikos@kernel.org does not designate 195.135.220.15 as permitted sender) smtp.mailfrom=jikos@kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from mx1.suse.de (mx2.suse.de. [195.135.220.15]) by mx.google.com with ESMTPS id z17-v6si1333488ejg.14.2019.01.05.09.27.07 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 05 Jan 2019 09:27:07 -0800 (PST) Received-SPF: softfail (google.com: domain of transitioning jikos@kernel.org does not designate 195.135.220.15 as permitted sender) client-ip=195.135.220.15; Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning jikos@kernel.org does not designate 195.135.220.15 as permitted sender) smtp.mailfrom=jikos@kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=kernel.org X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 24DAFAF09; Sat, 5 Jan 2019 17:27:07 +0000 (UTC) Date: Sat, 5 Jan 2019 18:27:05 +0100 (CET) From: Jiri Kosina To: Linus Torvalds , Andrew Morton , Greg KH , Peter Zijlstra , Michal Hocko cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Subject: [PATCH] mm/mincore: allow for making sys_mincore() privileged Message-ID: User-Agent: Alpine 2.21 (LSU 202 2017-01-01) MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Jiri Kosina There are possibilities [1] how mincore() could be used as a converyor of a sidechannel information about pagecache metadata. Provide vm.mincore_privileged sysctl, which makes it possible to mincore() start returning -EPERM in case it's invoked by a process lacking CAP_SYS_ADMIN. The default behavior stays "mincore() can be used by anybody" in order to be conservative with respect to userspace behavior. [1] https://www.theregister.co.uk/2019/01/05/boffins_beat_page_cache/ Signed-off-by: Jiri Kosina --- Documentation/sysctl/vm.txt | 9 +++++++++ kernel/sysctl.c | 8 ++++++++ mm/mincore.c | 5 +++++ 3 files changed, 22 insertions(+) diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt index 187ce4f599a2..afb8635e925e 100644 --- a/Documentation/sysctl/vm.txt +++ b/Documentation/sysctl/vm.txt @@ -41,6 +41,7 @@ Currently, these files are in /proc/sys/vm: - min_free_kbytes - min_slab_ratio - min_unmapped_ratio +- mincore_privileged - mmap_min_addr - mmap_rnd_bits - mmap_rnd_compat_bits @@ -485,6 +486,14 @@ files and similar are considered. The default is 1 percent. ============================================================== +mincore_privileged: + +mincore() could be potentially used to mount a side-channel attack against +pagecache metadata. This sysctl provides system administrators means to +make it available only to processess that own CAP_SYS_ADMIN capability. + +The default is 0, which means mincore() can be used without restrictions. +============================================================== mmap_min_addr diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 1825f712e73b..f03cb07c8dd4 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -114,6 +114,7 @@ extern unsigned int sysctl_nr_open_min, sysctl_nr_open_max; #ifndef CONFIG_MMU extern int sysctl_nr_trim_pages; #endif +extern int sysctl_mincore_privileged; /* Constants used for minimum and maximum */ #ifdef CONFIG_LOCKUP_DETECTOR @@ -1684,6 +1685,13 @@ static struct ctl_table vm_table[] = { .extra2 = (void *)&mmap_rnd_compat_bits_max, }, #endif + { + .procname = "mincore_privileged", + .data = &sysctl_mincore_privileged, + .maxlen = sizeof(sysctl_mincore_privileged), + .mode = 0644, + .proc_handler = proc_dointvec, + }, { } }; diff --git a/mm/mincore.c b/mm/mincore.c index 218099b5ed31..77d4928cdfaa 100644 --- a/mm/mincore.c +++ b/mm/mincore.c @@ -21,6 +21,8 @@ #include #include +int sysctl_mincore_privileged; + static int mincore_hugetlb(pte_t *pte, unsigned long hmask, unsigned long addr, unsigned long end, struct mm_walk *walk) { @@ -228,6 +230,9 @@ SYSCALL_DEFINE3(mincore, unsigned long, start, size_t, len, unsigned long pages; unsigned char *tmp; + if (sysctl_mincore_privileged && !capable(CAP_SYS_ADMIN)) + return -EPERM; + /* Check the start address: needs to be page-aligned.. */ if (start & ~PAGE_MASK) return -EINVAL; From patchwork Wed Jan 30 12:44:19 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vlastimil Babka X-Patchwork-Id: 10788513 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 34BBD1390 for ; Wed, 30 Jan 2019 12:45:19 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 227C32EB71 for ; Wed, 30 Jan 2019 12:45:19 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 16C2C2EBAE; Wed, 30 Jan 2019 12:45:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AB4702EBAD for ; Wed, 30 Jan 2019 12:45:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8A1D78E0001; Wed, 30 Jan 2019 07:45:16 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 84B548E0003; Wed, 30 Jan 2019 07:45:16 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6EDCA8E0005; Wed, 30 Jan 2019 07:45:16 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) by kanga.kvack.org (Postfix) with ESMTP id 342FC8E0003 for ; Wed, 30 Jan 2019 07:45:16 -0500 (EST) Received: by mail-ed1-f72.google.com with SMTP id i55so9393483ede.14 for ; Wed, 30 Jan 2019 04:45:16 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=gR8hjRmommIPz3aLtYKpIHs+oBCBI/oZoS9lhEjaZDg=; b=XdGsxWzM7lINEZNmTMDqg4NajmfkqxyjbqK8zJkTQn+eJaaqByV5NZRd5qFMmv3w0u QrUUBCF5MB2i8L2e1Ic1UZ8JjRMCwynYv4m5QV3cfiVdMaeyesy3jXA3FR8UZnNoJa3t 2jqbqCUw/Xw4C4/iF3xdcxjonRBOn/5vMRpQ3HuBPgzdHm2TBxGPfonPd4tuizNuKMrB kHOKXeZGF2lSlsJ98b00j2cUMLEG2NJprNw8Iy6I3PUsEWCAJ6dzvCQxh7T5dOKkxHrn CmiLxGK7YnZJ9ngzdu3suAGFayZtQ8ErsAEXT+Fn7CEM42alGZVKDeb5SbhkI5eOhUmL A2Fg== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of vbabka@suse.cz designates 195.135.220.15 as permitted sender) smtp.mailfrom=vbabka@suse.cz X-Gm-Message-State: AJcUukdWtruSGjSwxPEP+EMNjGH+HihpqeMNb1upeOUCGqw5NgILs++5 lOfRqPn/NJjajDtwcRG/4wnThCcVOvEYfDLDchefnknu8Wx54bVs8J1RQha2xy9ce8FNlYXaib+ Fy8nwRZueous65JtjlUxioTXU0tzV+mjilRNlvbHoe1AteBEyCCZUW0qMws5Z60RvFA== X-Received: by 2002:a50:f61e:: with SMTP id c30mr28992175edn.197.1548852315565; Wed, 30 Jan 2019 04:45:15 -0800 (PST) X-Google-Smtp-Source: ALg8bN6dgEgKO6DE47q4m2yOtTp9UWIyOFsef2yTW8ylEGHMQ2XpIVgjZ5BOCZXXXHOxuAencAkO X-Received: by 2002:a50:f61e:: with SMTP id c30mr28992097edn.197.1548852314169; Wed, 30 Jan 2019 04:45:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1548852314; cv=none; d=google.com; s=arc-20160816; b=FOuzUrcSCtkulEuTP5zqiqIa0+PBru8S8lldvnj1V+69/6UfK/0HEtOydkBUoze8OC c6ma4krd0ruMvAF6PQFPgB4RwZ5SDigtUfmm3/9Q0+//OALNgduW590zRdpP2WmRbNji sDExsmuNTvzlr77UYErG3E2ZHDi4SHmpgWdyyhIKOdDVfmeCnwI7uOUuuqPq9GLxX+ew tae2Y0llXwXl20yGYlD4v8QM/Dq1Ughxbs+CDOZoYCirK5QBHpqAIYDud6gEtiFtFrNZ P+20A6GSJdDCRLXlRgTJvx1n6aJo1IzBW3+glB+POl4ntEzDijeA/o0Hz69qH3ae2Lo8 Fdmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from; bh=gR8hjRmommIPz3aLtYKpIHs+oBCBI/oZoS9lhEjaZDg=; b=phUWKu0jMsj7VuJy4V///fk7/e7nI7zBhlyDcHCwH4tcRAB/71gohzl6G56SwxCzwF EHeQ2ZtwjK7ykjQZj/4/tTxxRCOG1KeAcKdkabVaGqY07MukH1LkS9ZQo69+4mRjeDxC RTaMk8j3wch4cYE48rPkTeggHGAN3A4s570Kf2SmFvR0fBS4SRCNttTI+Xz1/J7Z2XR3 CoK7SNZDqCNNG7U/QEgzWZdw33VqBrlkHwoEit+7L8zuVOfPp3OQr5mVk9OL2T+hykss Rc67ulExVDAE4RELiNNr0D/lX3vW6eu44tv2CM+m+2ifuuDhmD4n/Vpsik+FK9tPi/IT Xrcg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of vbabka@suse.cz designates 195.135.220.15 as permitted sender) smtp.mailfrom=vbabka@suse.cz Received: from mx1.suse.de (mx2.suse.de. [195.135.220.15]) by mx.google.com with ESMTPS id z10si865234edl.131.2019.01.30.04.45.14 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 Jan 2019 04:45:14 -0800 (PST) Received-SPF: pass (google.com: domain of vbabka@suse.cz designates 195.135.220.15 as permitted sender) client-ip=195.135.220.15; Authentication-Results: mx.google.com; spf=pass (google.com: domain of vbabka@suse.cz designates 195.135.220.15 as permitted sender) smtp.mailfrom=vbabka@suse.cz X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 41B7BAE88; Wed, 30 Jan 2019 12:45:13 +0000 (UTC) From: Vlastimil Babka To: Andrew Morton , Linus Torvalds Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-api@vger.kernel.org, Peter Zijlstra , Greg KH , Jann Horn , Jiri Kosina , Dominique Martinet , Andy Lutomirski , Dave Chinner , Kevin Easton , Matthew Wilcox , Cyril Hrubis , Tejun Heo , "Kirill A . Shutemov" , Daniel Gruss , Vlastimil Babka , Jiri Kosina Subject: [PATCH 2/3] mm/filemap: initiate readahead even if IOCB_NOWAIT is set for the I/O Date: Wed, 30 Jan 2019 13:44:19 +0100 Message-Id: <20190130124420.1834-3-vbabka@suse.cz> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190130124420.1834-1-vbabka@suse.cz> References: <20190130124420.1834-1-vbabka@suse.cz> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Jiri Kosina preadv2(RWF_NOWAIT) can be used to open a side-channel to pagecache contents, as it reveals metadata about residency of pages in pagecache. If preadv2(RWF_NOWAIT) returns immediately, it provides a clear "page not resident" information, and vice versa. Close that sidechannel by always initiating readahead on the cache if we encounter a cache miss for preadv2(RWF_NOWAIT); with that in place, probing the pagecache residency itself will actually populate the cache, making the sidechannel useless. Originally-by: Linus Torvalds Cc: Dominique Martinet Cc: Andy Lutomirski Cc: Dave Chinner Cc: Kevin Easton Cc: Matthew Wilcox Cc: Cyril Hrubis Cc: Tejun Heo Cc: Kirill A. Shutemov Cc: Daniel Gruss Signed-off-by: Jiri Kosina Signed-off-by: Vlastimil Babka --- mm/filemap.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index 9f5e323e883e..7bcdd36e629d 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2075,8 +2075,6 @@ static ssize_t generic_file_buffered_read(struct kiocb *iocb, page = find_get_page(mapping, index); if (!page) { - if (iocb->ki_flags & IOCB_NOWAIT) - goto would_block; page_cache_sync_readahead(mapping, ra, filp, index, last_index - index);