Re: [bug report] mm/hugetlb: possible data leak with huge pmd sharing

[Mike Kravetz <mike.kravetz@oracle.com>]

On 07/25/22 17:07, Miaohe Lin wrote:
> Hi all:
>     When I investigate the mm/hugetlb code, I found there's a possible data leak issue
> with huge pmd sharing. Thank about the below scene:
> 
>     1. Process A and process B shares huge pmd page.(vm_flags: VM_MAYSHARE but !VM_SHARED)

Thanks,

I often get confused about the setting of VM_MAYSHARE and VM_SHARED.  When
you throw in the possibility of shared and anonymous, then I struggle a bit
more.  At one time did an audit to get the meaning clear in my mind, but still
struggle with the meanings.

Is it possible to have VM_MAYSHARE and !VM_SHARED on a hugetlb vma?  I only
took a quick look and could not find a way for this to happen.  But, I
could have easily missed something.

-- 
Mike Kravetz

>     2. Process A write fault a hugetlb page. As vm_flags is !VM_SHARED, a private copy of
> hugetlb page will be installed in the pagetable via hugetlb_wp.
>     3. Process A writes private data into hugetlb page.
>     4. Process B can read process A's private data since hugetlb page is shared through huge
> pmd sharing...
> 
> I think the above scene is possible. If so, huge pmd sharing for !VM_SHARED should be disabled
> to fix this issue? Or am I miss something about hugetlb huge pmd sharing?
> 
> Any response would be appreciated.
> 
> Thanks! :)