From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752073AbcAFCqP (ORCPT ); Tue, 5 Jan 2016 21:46:15 -0500 Received: from mail-pf0-f175.google.com ([209.85.192.175]:33621 "EHLO mail-pf0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751769AbcAFCqN (ORCPT ); Tue, 5 Jan 2016 21:46:13 -0500 Subject: Re: [kernel-hardening] [RFC][PATCH 6/7] mm: Add Kconfig option for slab sanitization To: Kees Cook References: <1450755641-7856-1-git-send-email-laura@labbott.name> <1450755641-7856-7-git-send-email-laura@labbott.name> <567964F3.2020402@intel.com> <567986E7.50107@intel.com> <56798851.60906@intel.com> <5679943C.1050604@intel.com> <5679A0CB.3060707@labbott.name> Cc: Dave Hansen , Christoph Lameter , "kernel-hardening@lists.openwall.com" , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Linux-MM , LKML From: Laura Abbott Message-ID: <568C7FF3.9070408@labbott.name> Date: Tue, 5 Jan 2016 18:46:11 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 1/5/16 4:29 PM, Kees Cook wrote: > On Tue, Dec 22, 2015 at 11:13 AM, Laura Abbott wrote: >> On 12/22/15 10:19 AM, Dave Hansen wrote: >>> >>> On 12/22/2015 10:08 AM, Christoph Lameter wrote: >>>> >>>> On Tue, 22 Dec 2015, Dave Hansen wrote: >>>>>> >>>>>> Why would you use zeros? The point is just to clear the information >>>>>> right? >>>>>> The regular poisoning does that. >>>>> >>>>> >>>>> It then allows you to avoid the zeroing at allocation time. >>>> >>>> >>>> Well much of the code is expecting a zeroed object from the allocator and >>>> its zeroed at that time. Zeroing makes the object cache hot which is an >>>> important performance aspect. >>> >>> >>> Yes, modifying this behavior has a performance impact. It absolutely >>> needs to be evaluated, and I wouldn't want to speculate too much on how >>> good or bad any of the choices are. >>> >>> Just to reiterate, I think we have 3 real choices here: >>> >>> 1. Zero at alloc, only when __GFP_ZERO >>> (behavior today) >>> 2. Poison at free, also Zero at alloc (when __GFP_ZERO) >>> (this patch's proposed behavior, also what current poisoning does, >>> doubles writes) >>> 3. Zero at free, *don't* Zero at alloc (when __GFP_ZERO) >>> (what I'm suggesting, possibly less perf impact vs. #2) >>> >>> >> >> poisoning with non-zero memory makes it easier to determine that the error >> came from accessing the sanitized memory vs. some other case. I don't think >> the feature would be as strong if the memory was only zeroed vs. some other >> data value. > > I would tend to agree. If there are significant perf improvements for > "3" above, that should be easy to add on later as another choice. > I was looking at the sanitization for the buddy allocator that exists in grsecurity and that does option #3 (zero at free, skip __GFP_ZERO). I'm going to look into adding that as an option for the slab allocator and see what the performance numbers show. Thanks, Laura