From patchwork Fri Mar 29 11:54:46 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: York Jasper Niebuhr X-Patchwork-Id: 13610591 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4750EC6FD1F for ; Fri, 29 Mar 2024 11:55:24 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A6BE96B0083; Fri, 29 Mar 2024 07:55:23 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A1C9F6B0087; Fri, 29 Mar 2024 07:55:23 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8BBF26B0088; Fri, 29 Mar 2024 07:55:23 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 6E93F6B0083 for ; Fri, 29 Mar 2024 07:55:23 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 3455516124A for ; Fri, 29 Mar 2024 11:55:23 +0000 (UTC) X-FDA: 81949921326.06.ED6A1E2 Received: from mail-ej1-f41.google.com (mail-ej1-f41.google.com [209.85.218.41]) by imf22.hostedemail.com (Postfix) with ESMTP id 53543C001C for ; Fri, 29 Mar 2024 11:55:21 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=IPifuOrq; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf22.hostedemail.com: domain of yjnworkstation@gmail.com designates 209.85.218.41 as permitted sender) smtp.mailfrom=yjnworkstation@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1711713321; a=rsa-sha256; cv=none; b=avMHTg/bq23TdEIFcfkDHd6hWQcfuCRQ9zpORcne2JgfukOt3s950jF+a4Fsc+4FOMFBaz xVfw2pUhPPe+6wCtLyz/r1tt3rlO7nTbnj9rPcKy5hpOoKdQ1ZFgmVVQ9l75JAxdsyt40/ fsfefzfzFcjzdHKjK0L9dyn0qwEYxXY= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=IPifuOrq; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf22.hostedemail.com: domain of yjnworkstation@gmail.com designates 209.85.218.41 as permitted sender) smtp.mailfrom=yjnworkstation@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1711713321; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=DIxw1PcXGefM3kdpxyhMRDNDxZIx4eG1CWgE8oLWWJs=; b=dHmQwdv/F3THrtd9GRtx7+9cvPV+hRz+3w4b/q7HtKzHW9jMHZGEyDnY8KwLu0/2j2rv8r ysMPQY7QXGTCmxDYvQPD1QBjPNk7v3zp4zNA55/ii1RaMH0TSvksXkwQlnuFT7QeyscSK4 80ytJ57JPp4l7xkm1SRzsW0yHz39Le0= Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-a4751063318so242698066b.0 for ; Fri, 29 Mar 2024 04:55:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1711713320; x=1712318120; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=DIxw1PcXGefM3kdpxyhMRDNDxZIx4eG1CWgE8oLWWJs=; b=IPifuOrq4fLFuL+6RccvwpdIHLyOqnsdxvm0VDLNs/GHgObvtj72jj3kqyXQDAt4CM fqemSlOIEw/XNH4ynXSsYp/df1QYBjFRTMKjOSHolx+2YpC53ori2iXMGCR0aHr0BarD f7eCHom2QHIck08cSXPCJUxMoR3HfR1XlOc2LACanxb+ptq5nTme0hqdFTNRC8K506iZ rVkK5egLFgPIzTBtHS/6HBMd5rrH+EX64fLXKi5B8kYBXAfah3tPoFuSodR5gPhb1REW jbp3Y3bz0i7qZ4Gaz/3+kqYUyhten27nsxaMDu6CwztImYORfe3QvsMWHLFOb79fvtnB nhpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1711713320; x=1712318120; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=DIxw1PcXGefM3kdpxyhMRDNDxZIx4eG1CWgE8oLWWJs=; b=MGVULCVePfZvFGR3hDQVw9ZU05/q3u8cmRXMjDHV803GOkqSAfI6++kFpKxWkyRvUV YDqucNnsSxKevhxMmjUu1Dal2/6oYP0Iyh/c+QEZgmHBxTNa3zyh0dOl6wuMQzom7dM0 /GxB7ME7TQbXPoPouoX5kOXkfgSNDQrD50pYf4fgOZSuPs1YV+4c4fWMyrDH33OPT4dd NlHOkJKo7ZGrP/uQ14GM77+RTDeM7Tm42CdmO6iuHEw7127uHLG77R1eVnqakguqHZ/N p0JhKEiJvurV/i0l0uBshrshvOCe5CpjaDy5e6/po1PO7YmWLU/hOUZaRc3RSQyqhE5T 30fg== X-Forwarded-Encrypted: i=1; AJvYcCWTYQoxQpbFc1zqaBmLySWpw5kT0Ccp4yL95Zpn74eWrcgH4qw0sW/sQfxf3jVMvjUQzkoknbj78Qz0l/X6ln9vclU= X-Gm-Message-State: AOJu0YxhEtL2tRrg+hAAhFXLWE/e+On9sqeWlxQMw9YTRA1bzSHH6zmE x8EmmXSoNb9OyQcvTTtOzjRHzmYtSzy2HT/ojvhuXE8RUaOsE0qp X-Google-Smtp-Source: AGHT+IG9zVoRV47w2xMtdfOHPvRAA4Up+2xDXK5mDuSQe4CXd5hCfUHD+L4MCoQDkigY4XPkmPYQ+g== X-Received: by 2002:a17:906:a043:b0:a4e:287c:255a with SMTP id bg3-20020a170906a04300b00a4e287c255amr1279274ejb.12.1711713319307; Fri, 29 Mar 2024 04:55:19 -0700 (PDT) Received: from yjn-Lenovo-V14-G2-ITL.fritz.box (p200300dcbf1966000d807ab11579b0e4.dip0.t-ipconnect.de. [2003:dc:bf19:6600:d80:7ab1:1579:b0e4]) by smtp.gmail.com with ESMTPSA id h6-20020a170906590600b00a46e56c8764sm1843529ejq.114.2024.03.29.04.55.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Mar 2024 04:55:18 -0700 (PDT) From: York Jasper Niebuhr To: akpm@linux-foundation.org Cc: linux-kernel@vger.kernel.org, willy@linux.intel.com, linux-mm@kvack.org, York Jasper Niebuhr Subject: [PATCH] mm: init_mlocked_on_free_v3 Date: Fri, 29 Mar 2024 12:54:46 +0100 Message-Id: <20240329115446.424923-1-yjnworkstation@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 53543C001C X-Stat-Signature: 1nrh8xpagb674ym7jft4ktdkmwk5d7un X-HE-Tag: 1711713321-993463 X-HE-Meta: U2FsdGVkX18jQpGrNwV2aS71yaeK+VpSTNeryG7uZAyMcM2GKs/KyFONao5rZbb3oeCmhFud81AzPnHP7JZnbaPeGT0+M4yTJHoGG1SjIzzU4Pfd6jBH7aCyzdD6eoq9UIqgQ3XpW4KJ68iSxNp5P5WbHRCgIqbFX1nBo1VYfIWsPqmhKgUbSfKKWWzHU5+GXEmFy9OiBE01hbhrB72yeEEDX0ApFjmApKKHtOwUK+SrEA4lD+8tQUY16MESG2eMtIZxOBB6deWVC1NjW+32tkfnSunCkEC5lVxPFkv4quxN9znZaCE+JNP1wc3UaET+eFll5qrF7/N2yloWlEoS5JlAW1Q4aZ9Vmvu6RdMe7LRGSL3caW4VYA025LpVhQMGRNzT0b3FblW/RImjULh7DvHcVRv0RZwZeqvZz6Wn0I33d3Xrykss7ZSxCvKZQN6hIZ6u8VJOMTA0zl9vvUJEJrF4vBy6Bh887qKYeFY24xKmoTnFheWLAUkVV1qLGuYDhfY9D5fTvh5bewsw+szkMj2crHH9n1bAvWk+V2pVxyMV6ppVOwd+QoTXWyN0+svdJ/X12NgUBT8v3M1o0g02VBYwk8Q15Zu8weIK1dIIhbeeubaXphta97im0UlnfUapGJ7emkEvILGISQ3uJHx/pVIJnqYzitF2W1IR6fedffVxG0U909xqNPhHQag9f1JbCzR8zTWrSdk3OYMPKQ8nFrGNV8ObC7Z+Z3KKGVhXc6UOGdXCkHLBdOjlURL+WjauKlM31va6yr3KdBHDyDO9HdT9fDI1bsadT35x5rDpIlS88vz19dAW6RTT6yzGqR1SAaF4mJebVoQnWDiHR/ZvRQqEbWahVWjpG6hJjjtrp8B7pHwRoPPK4yH8n3p8WFNDIiFkC1uBz8XSjv5uhe1I0R/J/ZIpPCfle/EODUOivMf+Jeustja6KC2Fu/72lfxgI93zDsQcwasEljTIxR+ N1ae1Px/ UR5GSGZoiyFz7+wZRwX4F1VmKM6hKNh90XmXFY7Kun7dZN0cRTSkzloSP9hehFm2yLa2k/zerpQw1hetDKlRLWhs0IGkFyg8WQX91JsrIdJU2kvGzJvuKZfg1ylAAE2mS9F9pE6dHvGODUwgetQ0ZnrbaATevTV62y9T+SQS6Cs5oGscUE1ifQRGB3V2FJzeyM9okOp9JpUxQVqPt93qDvJuWmhgN/o4OHnd1M+/RjdWqBNk9o5GXtfCGT3f6DMhaKHKOLajZOeek2qxIbNaBc+RzunYZ5UImXwhnBKi3bjLqR6EKC0OTTdM//XjrCou3B2i6nKIY5S5eqbXMejA7CfbkPMXFiTLW9BV5irW71kGhRhF/T/FXSr2wIlt7xmvmDp6FkWnNiL8qW2VxaNzHTYkTbooooaEIBvbn+kmCczBT+CrrX1B3EPFTIHIi2Q4zry7ib9VgUqzZAOWOAZ4jYxEbqclddewBI4Lds9JBMRoQt0j1ZpvsYHB8Wg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Implements the "init_mlocked_on_free" boot option. When this boot option is enabled, any mlock'ed pages are zeroed on free. If the pages are munlock'ed beforehand, no initialization takes place. This boot option is meant to combat the performance hit of "init_on_free" as reported in commit 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options"). With "init_mlocked_on_free=1" only relevant data is freed while everything else is left untouched by the kernel. Correspondingly, this patch introduces no performance hit for unmapping non-mlock'ed memory. The unmapping overhead for purely mlocked memory was measured to be approximately 13%. Realistically, most systems mlock only a fraction of the total memory so the real-world system overhead should be close to zero. Optimally, userspace programs clear any key material or other confidential memory before exit and munlock the according memory regions. If a program crashes, userspace key managers fail to do this job. Accordingly, no munlock operations are performed so the data is caught and zeroed by the kernel. Should the program not crash, all memory will ideally be munlocked so no overhead is caused. CONFIG_INIT_MLOCKED_ON_FREE_DEFAULT_ON can be set to enable "init_mlocked_on_free" by default. Signed-off-by: York Jasper Niebuhr --- .../admin-guide/kernel-parameters.txt | 6 +++ include/linux/mm.h | 9 +++- mm/internal.h | 1 + mm/memory.c | 6 +++ mm/mm_init.c | 43 ++++++++++++++++--- mm/page_alloc.c | 2 +- security/Kconfig.hardening | 15 +++++++ 7 files changed, 73 insertions(+), 9 deletions(-) base-commit: a6bd6c9333397f5a0e2667d4d82fef8c970108f2 diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index bb884c14b2f6..34bdbf29aaf9 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -2148,6 +2148,12 @@ Format: 0 | 1 Default set by CONFIG_INIT_ON_FREE_DEFAULT_ON. + init_mlocked_on_free= [MM] Fill freed userspace memory with zeroes if + it was mlock'ed and not explicitly munlock'ed + afterwards. + Format: 0 | 1 + Default set by CONFIG_INIT_MLOCKED_ON_FREE_DEFAULT_ON + init_pkru= [X86] Specify the default memory protection keys rights register contents for all processes. 0x55555554 by default (disallow access to all but pkey 0). Can diff --git a/include/linux/mm.h b/include/linux/mm.h index 8eccaabe44ee..a216489aef2b 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3751,7 +3751,14 @@ DECLARE_STATIC_KEY_MAYBE(CONFIG_INIT_ON_FREE_DEFAULT_ON, init_on_free); static inline bool want_init_on_free(void) { return static_branch_maybe(CONFIG_INIT_ON_FREE_DEFAULT_ON, - &init_on_free); + &init_on_free); +} + +DECLARE_STATIC_KEY_MAYBE(CONFIG_INIT_MLOCKED_ON_FREE_DEFAULT_ON, init_mlocked_on_free); +static inline bool want_init_mlocked_on_free(void) +{ + return static_branch_maybe(CONFIG_INIT_MLOCKED_ON_FREE_DEFAULT_ON, + &init_mlocked_on_free); } extern bool _debug_pagealloc_enabled_early; diff --git a/mm/internal.h b/mm/internal.h index 8e11f7b2da21..8ec85b5e62e6 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -506,6 +506,7 @@ extern void __putback_isolated_page(struct page *page, unsigned int order, extern void memblock_free_pages(struct page *page, unsigned long pfn, unsigned int order); extern void __free_pages_core(struct page *page, unsigned int order); +extern void kernel_init_pages(struct page *page, int numpages); /* * This will have no effect, other than possibly generating a warning, if the diff --git a/mm/memory.c b/mm/memory.c index 36191a9c799c..861d93c3e444 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1506,6 +1506,12 @@ static __always_inline void zap_present_folio_ptes(struct mmu_gather *tlb, if (unlikely(page_mapcount(page) < 0)) print_bad_pte(vma, addr, ptent, page); } + + if (want_init_mlocked_on_free() && folio_test_mlocked(folio) + && !delay_rmap && folio_test_anon(folio)) { + kernel_init_pages(page, 1); + } + if (unlikely(__tlb_remove_folio_pages(tlb, page, nr, delay_rmap))) { *force_flush = true; *force_break = true; diff --git a/mm/mm_init.c b/mm/mm_init.c index e3450f12d79a..d99b3e21686d 100644 --- a/mm/mm_init.c +++ b/mm/mm_init.c @@ -2515,6 +2515,9 @@ EXPORT_SYMBOL(init_on_alloc); DEFINE_STATIC_KEY_MAYBE(CONFIG_INIT_ON_FREE_DEFAULT_ON, init_on_free); EXPORT_SYMBOL(init_on_free); +DEFINE_STATIC_KEY_MAYBE(CONFIG_INIT_MLOCKED_ON_FREE_DEFAULT_ON, init_mlocked_on_free); +EXPORT_SYMBOL(init_mlocked_on_free); + static bool _init_on_alloc_enabled_early __read_mostly = IS_ENABLED(CONFIG_INIT_ON_ALLOC_DEFAULT_ON); static int __init early_init_on_alloc(char *buf) @@ -2532,6 +2535,14 @@ static int __init early_init_on_free(char *buf) } early_param("init_on_free", early_init_on_free); +static bool _init_mlocked_on_free_enabled_early __read_mostly + = IS_ENABLED(CONFIG_INIT_MLOCKED_ON_FREE_DEFAULT_ON); +static int __init early_init_mlocked_on_free(char *buf) +{ + return kstrtobool(buf, &_init_mlocked_on_free_enabled_early); +} +early_param("init_mlocked_on_free", early_init_mlocked_on_free); + DEFINE_STATIC_KEY_MAYBE(CONFIG_DEBUG_VM, check_pages_enabled); /* @@ -2559,12 +2570,21 @@ static void __init mem_debugging_and_hardening_init(void) } #endif - if ((_init_on_alloc_enabled_early || _init_on_free_enabled_early) && + if ((_init_on_alloc_enabled_early || _init_on_free_enabled_early + || _init_mlocked_on_free_enabled_early) && page_poisoning_requested) { pr_info("mem auto-init: CONFIG_PAGE_POISONING is on, " - "will take precedence over init_on_alloc and init_on_free\n"); + "will take precedence over init_on_alloc, init_on_free " + "and init_mlocked_on_free\n"); _init_on_alloc_enabled_early = false; _init_on_free_enabled_early = false; + _init_mlocked_on_free_enabled_early = false; + } + + if (_init_mlocked_on_free_enabled_early && _init_on_free_enabled_early) { + pr_info("mem auto-init: init_on_free is on, " + "will take precedence over init_mlocked_on_free\n"); + _init_mlocked_on_free_enabled_early = false; } if (_init_on_alloc_enabled_early) { @@ -2581,9 +2601,17 @@ static void __init mem_debugging_and_hardening_init(void) static_branch_disable(&init_on_free); } - if (IS_ENABLED(CONFIG_KMSAN) && - (_init_on_alloc_enabled_early || _init_on_free_enabled_early)) - pr_info("mem auto-init: please make sure init_on_alloc and init_on_free are disabled when running KMSAN\n"); + if (_init_mlocked_on_free_enabled_early) { + want_check_pages = true; + static_branch_enable(&init_mlocked_on_free); + } else { + static_branch_disable(&init_mlocked_on_free); + } + + if (IS_ENABLED(CONFIG_KMSAN) && (_init_on_alloc_enabled_early + || _init_on_free_enabled_early || _init_mlocked_on_free_enabled_early)) + pr_info("mem auto-init: please make sure init_on_alloc, init_on_free and " + "init_mlocked_on_free are disabled when running KMSAN\n"); #ifdef CONFIG_DEBUG_PAGEALLOC if (debug_pagealloc_enabled()) { @@ -2622,9 +2650,10 @@ static void __init report_meminit(void) else stack = "off"; - pr_info("mem auto-init: stack:%s, heap alloc:%s, heap free:%s\n", + pr_info("mem auto-init: stack:%s, heap alloc:%s, heap free:%s, mlocked free:%s\n", stack, want_init_on_alloc(GFP_KERNEL) ? "on" : "off", - want_init_on_free() ? "on" : "off"); + want_init_on_free() ? "on" : "off", + want_init_mlocked_on_free() ? "on" : "off"); if (want_init_on_free()) pr_info("mem auto-init: clearing system memory may take some time...\n"); } diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 5b8ab1bfb9d5..8a8ca555b9d6 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1038,7 +1038,7 @@ static inline bool should_skip_kasan_poison(struct page *page) return page_kasan_tag(page) == KASAN_TAG_KERNEL; } -static void kernel_init_pages(struct page *page, int numpages) +void kernel_init_pages(struct page *page, int numpages) { int i; diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening index 2cff851ebfd7..effbf5982be1 100644 --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -255,6 +255,21 @@ config INIT_ON_FREE_DEFAULT_ON touching "cold" memory areas. Most cases see 3-5% impact. Some synthetic workloads have measured as high as 8%. +config INIT_MLOCKED_ON_FREE_DEFAULT_ON + bool "Enable mlocked memory zeroing on free" + depends on !KMSAN + help + This config has the effect of setting "init_mlocked_on_free=1" + on the kernel command line. If it is enabled, all mlocked process + memory is zeroed when freed. This restriction to mlocked memory + improves performance over "init_on_free" but can still be used to + protect confidential data like key material from content exposures + to other processes, as well as live forensics and cold boot attacks. + Any non-mlocked memory is not cleared before it is reassigned. This + configuration can be overwritten by setting "init_mlocked_on_free=0" + on the command line. The "init_on_free" boot option takes + precedence over "init_mlocked_on_free". + config CC_HAS_ZERO_CALL_USED_REGS def_bool $(cc-option,-fzero-call-used-regs=used-gpr) # https://github.com/ClangBuiltLinux/linux/issues/1766