TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "mm: init_mlocked_on_free_v3"

Browse Source 
There was insufficient review and no agreement that this is the right
approach.

There are serious flaws with the implementation that make processes using
mlock() not even work with simple fork() [1] and we get reliable crashes
when rebooting.

Further, simply because we might be unmapping a single PTE of a large
mlocked folio, we shouldn't zero out the whole folio.

... especially because the code can also *corrupt* urelated memory because
	kernel_init_pages(page, folio_nr_pages(folio));

Could end up writing outside of the actual folio if we work with a tail
page.

Let's revert it.  Once there is agreement that this is the right approach,
the issues were fixed and there was reasonable review and proper testing,
we can consider it again.

[1] https://lkml.kernel.org/r/4da9da2f-73e4-45fd-b62f-a8a513314057@redhat.com

Link: https://lkml.kernel.org/r/20240605091710.38961-1-david@redhat.com
Fixes: ba42b524a0 ("mm: init_mlocked_on_free_v3")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reported-by: David Wang <00107082@163.com>
Closes: https://lore.kernel.org/lkml/20240528151340.4282-1-00107082@163.com/
Reported-by: Lance Yang <ioworker0@gmail.com>
Closes: https://lkml.kernel.org/r/20240601140917.43562-1-ioworker0@gmail.com
Acked-by: Lance Yang <ioworker0@gmail.com>
Cc: York Jasper Niebuhr <yjnworkstation@gmail.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
David Hildenbrand
2024-06-05 11:17:10 +02:00
committed by Andrew Morton
parent 8bb592c2ec
commit 384a746bb5
7 changed files with 9 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/Kconfig.hardening
-15
View File
@@ -255,21 +255,6 @@ config INIT_ON_FREE_DEFAULT_ON
touching "cold" memory areas. Most cases see 3-5% impact. Some
synthetic workloads have measured as high as 8%.
config INIT_MLOCKED_ON_FREE_DEFAULT_ON
bool "Enable mlocked memory zeroing on free"
depends on !KMSAN
help
This config has the effect of setting "init_mlocked_on_free=1"
on the kernel command line. If it is enabled, all mlocked process
memory is zeroed when freed. This restriction to mlocked memory
improves performance over "init_on_free" but can still be used to
protect confidential data like key material from content exposures
to other processes, as well as live forensics and cold boot attacks.
Any non-mlocked memory is not cleared before it is reassigned. This
configuration can be overwritten by setting "init_mlocked_on_free=0"
on the command line. The "init_on_free" boot option takes
precedence over "init_mlocked_on_free".
config CC_HAS_ZERO_CALL_USED_REGS
def_bool $(cc-option,-fzero-call-used-regs=used-gpr)
# https://github.com/ClangBuiltLinux/linux/issues/1766