Skip to content

Commit

Permalink
mm/secretmem: use refcount_t instead of atomic_t
Browse files Browse the repository at this point in the history
When a secret memory region is active, memfd_secret disables hibernation.
One of the goals is to keep the secret data from being written to
persistent-storage.

It accomplishes this by maintaining a reference count to
`secretmem_users`.  Once this reference is held your system can not be
hibernated due to the check in `hibernation_available()`.  However,
because `secretmem_users` is of type `atomic_t`, reference counter
overflows are possible.

As you can see there's an `atomic_inc` for each `memfd` that is opened in
the `memfd_secret` syscall.  If a local attacker succeeds to open 2^32
memfd's, the counter will wrap around to 0.  This implies that you may
hibernate again, even though there are still regions of this secret
memory, thereby bypassing the security check.

In an attempt to fix this I have used `refcount_t` instead of `atomic_t`
which prevents reference counter overflows.

Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Jordy Zomer <[email protected]>
Cc: Kees Cook <[email protected]>,
Cc: Jordy Zomer <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: Mike Rapoport <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
  • Loading branch information
Jordy Zomer authored and torvalds committed Sep 8, 2021
1 parent 41c961b commit 1108605
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions mm/secretmem.c
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
#include <linux/secretmem.h>
#include <linux/set_memory.h>
#include <linux/sched/signal.h>
#include <linux/refcount.h>

#include <uapi/linux/magic.h>

Expand All @@ -40,11 +41,11 @@ module_param_named(enable, secretmem_enable, bool, 0400);
MODULE_PARM_DESC(secretmem_enable,
"Enable secretmem and memfd_secret(2) system call");

static atomic_t secretmem_users;
static refcount_t secretmem_users;

bool secretmem_active(void)
{
return !!atomic_read(&secretmem_users);
return !!refcount_read(&secretmem_users);
}

static vm_fault_t secretmem_fault(struct vm_fault *vmf)
Expand Down Expand Up @@ -103,7 +104,7 @@ static const struct vm_operations_struct secretmem_vm_ops = {

static int secretmem_release(struct inode *inode, struct file *file)
{
atomic_dec(&secretmem_users);
refcount_dec(&secretmem_users);
return 0;
}

Expand Down Expand Up @@ -217,7 +218,7 @@ SYSCALL_DEFINE1(memfd_secret, unsigned int, flags)
file->f_flags |= O_LARGEFILE;

fd_install(fd, file);
atomic_inc(&secretmem_users);
refcount_inc(&secretmem_users);
return fd;

err_put_fd:
Expand Down

0 comments on commit 1108605

Please sign in to comment.