The patch titled
Subject: mm/mincore.c: make mincore() more conservative
has been removed from the -mm tree. Its filename was
mm-mincore-make-mincore-more-conservative.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Jiri Kosina <jkosina@xxxxxxx>
Subject: mm/mincore.c: make mincore() more conservative
The semantics of what mincore() considers to be resident is not completely
clear, but Linux has always (since 2.3.52, which is when mincore() was
initially done) treated it as "page is available in page cache".
That's potentially a problem, as that [in]directly exposes
meta-information about pagecache / memory mapping state even about memory
not strictly belonging to the process executing the syscall, opening
possibilities for sidechannel attacks.
Change the semantics of mincore() so that it only reveals pagecache
information for non-anonymous mappings that belog to files that the
calling process could (if it tried to) successfully open for writing;
otherwise we'd be including shared non-exclusive mappings, which
- is the sidechannel
- is not the usecase for mincore(), as that's primarily used for data, not
(shared) text
[jkosina@xxxxxxx: v2]
Link: http://lkml.kernel.org/r/20190312141708.6652-2-vbabka@xxxxxxx
[mhocko@xxxxxxxx: restructure can_do_mincore() conditions]
Link: http://lkml.kernel.org/r/nycvar.YFH.7.76.1903062342020.19912@xxxxxxxxxxxxx
Signed-off-by: Jiri Kosina <jkosina@xxxxxxx>
Signed-off-by: Vlastimil Babka <vbabka@xxxxxxx>
Acked-by: Josh Snyder <joshs@xxxxxxxxxxx>
Acked-by: Michal Hocko <mhocko@xxxxxxxx>
Originally-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Originally-by: Dominique Martinet <asmadeus@xxxxxxxxxxxxx>
Cc: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
Cc: Dave Chinner <david@xxxxxxxxxxxxx>
Cc: Kevin Easton <kevin@xxxxxxxxxxx>
Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
Cc: Cyril Hrubis <chrubis@xxxxxxx>
Cc: Tejun Heo <tj@xxxxxxxxxx>
Cc: Kirill A. Shutemov <kirill@xxxxxxxxxxxxx>
Cc: Daniel Gruss <daniel@xxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/mincore.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
--- a/mm/mincore.c~mm-mincore-make-mincore-more-conservative
+++ a/mm/mincore.c
@@ -169,6 +169,22 @@ out:
return 0;
}
+static inline bool can_do_mincore(struct vm_area_struct *vma)
+{
+ if (vma_is_anonymous(vma))
+ return true;
+ if (!vma->vm_file)
+ return false;
+ /*
+ * Reveal pagecache information only for non-anonymous mappings that
+ * correspond to the files the calling process could (if tried) open
+ * for writing; otherwise we'd be including shared non-exclusive
+ * mappings, which opens a side channel.
+ */
+ return inode_owner_or_capable(file_inode(vma->vm_file)) ||
+ inode_permission(file_inode(vma->vm_file), MAY_WRITE) == 0;
+}
+
/*
* Do a chunk of "sys_mincore()". We've already checked
* all the arguments, we hold the mmap semaphore: we should
@@ -189,8 +205,13 @@ static long do_mincore(unsigned long add
vma = find_vma(current->mm, addr);
if (!vma || addr < vma->vm_start)
return -ENOMEM;
- mincore_walk.mm = vma->vm_mm;
end = min(vma->vm_end, addr + (pages << PAGE_SHIFT));
+ if (!can_do_mincore(vma)) {
+ unsigned long pages = DIV_ROUND_UP(end - addr, PAGE_SIZE);
+ memset(vec, 1, pages);
+ return pages;
+ }
+ mincore_walk.mm = vma->vm_mm;
err = walk_page_range(addr, end, &mincore_walk);
if (err < 0)
return err;
_
Patches currently in -mm which might be from jkosina@xxxxxxx are
