[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 3 Jul 2011 12:10:29 -0700
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: Vasiliy Kulikov <segoon@...nwall.com>
Cc: kernel-hardening@...ts.openwall.com, Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, "H. Peter Anvin" <hpa@...or.com>,
x86@...nel.org, Arnd Bergmann <arnd@...db.de>,
Christoph Lameter <cl@...ux-foundation.org>,
Pekka Enberg <penberg@...nel.org>, Matt Mackall <mpm@...enic.com>,
Andrew Morton <akpm@...ux-foundation.org>,
linux-kernel@...r.kernel.org, linux-arch@...r.kernel.org,
linux-mm@...ck.org
Subject: Re: [RFC v1] implement SL*B and stack usercopy runtime checks
On Sun, Jul 3, 2011 at 11:57 AM, Vasiliy Kulikov <segoon@...nwall.com> wrote:
>> If you seriously clean it up (that at a minimum includes things like
>> making it configurable using some pretty helper function that just
>> compiles away for all the normal cases,
>
> Hm, it is not as simple as it looks at the first glance - even if the
> object size is known at the compile time (__compiletime_object_size), it
> might be a field of a structure, which crosses the slab object
> boundaries because of an overflow.
No, I was more talking about having something like
#ifdef CONFIG_EXPENSIVE_CHECK_USERCOPY
extern int check_user_copy(const void *kptr, unsigned long size);
#else
static inline int check_user_copy(const void *kptr, unsigned long size)
{ return 0; }
#endif
so that the actual user-copy routines end up being clean and not have
#ifdefs in them or any implementation details like what you check
(stack, slab, page cache - whatever)
If you can also make it automatically not generate any code for cases
that are somehow obviously safe, then that's an added bonus.
But my concern is that performance is a real issue, and the strict
user-copy checking sounds like mostly a "let's enable this for testing
kernels when chasing some particular issue" feature, the way
DEBUG_PAGEALLOC is. And at the same time, code cleanliness and
maintainability is a big deal, so the usercopy code itself should have
minimal impact and look nice regardless (which is why I strongly
object to that kind of "(!slab_access_ok(to, n) ||
!stack_access_ok(to, n))" crud - the internal details of what you
check are *totally* irrelevant to the usercopy code.
Linus
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
