On Tue 12-02-19 04:44:30, Jiri Kosina wrote:
> On Fri, 1 Feb 2019, Vlastimil Babka wrote:
>
> > >> After "mm/mincore: make mincore() more conservative" we sometimes
> > >> restrict the
> > >> information about page cache residency, which we have to do without
> > >> breaking
> > >> existing userspace, if possible. We thus fake the resulting values as 1,
> > >> which
> > >> should be safer than faking them as 0, as there might theoretically
> > >> exist code
> > >> that would try to fault in the page(s) until mincore() returns 1.
> > >>
> > >> Faking 1 however means that such code would not fault in a page even if
> > >> it was
> > >> not in page cache, with unwanted performance implications. We can
> > >> improve the
> > >> situation by revisting the approach of 574823bfab82 ("Change mincore()
> > >> to count
> > >> "mapped" pages rather than "cached" pages") but only applying it to
> > >> cases where
> > >> page cache residency check is restricted. Thus mincore() will return 0
> > >> for an
> > >> unmapped page (which may or may not be resident in a pagecache), and 1
> > >> after
> > >> the process faults it in.
> > >>
> > >> One potential downside is that mincore() will be again able to recognize
> > >> when a
> > >> previously mapped page was reclaimed. While that might be useful for some
> > >> attack scenarios, it's not as crucial as recognizing that somebody else
> > >> faulted
> > >> the page in, and there are also other ways to recognize reclaimed pages
> > >> anyway.
> > >
> > > Is this really worth it? Do we know about any specific usecase that
> > > would benefit from this change? TBH I would rather wait for the report
> > > than add a hard to evaluate side channel.
> >
> > Well it's not that complicated IMHO. Linus said it's worth trying, so
> > let's see how he likes the result. The side channel exists anyway as
> > long as process can e.g. check if its rss shrinked, and I doubt we are
> > going to remove that possibility.
>
> So, where do we go from here?
>
> Either Linus and Andrew like the mincore() return value tweak, or this
> could be further discussed (*). But in either of the cases, I think
> patches 1 and 2 should be at least queued for 5.1.
I would go with patch 1 for 5.1. Patches 2 still sounds controversial or
incomplete to me. And patch 3, well I will leave the decision to
Andrew/Linus.
> (*) I'd personally include it as well, as I don't see how it would break
> anything, it's pretty straightforward, and brings back some sanity to
> mincore() return value.
--
Michal Hocko
SUSE Labs
