Date: Fri, 7 Jul 2017 11:43:33 -0700 From: Kees Cook <keescook@...omium.org> To: Christoph Lameter <cl@...ux.com> Cc: Rik van Riel <riel@...hat.com>, Andrew Morton <akpm@...ux-foundation.org>, Pekka Enberg <penberg@...nel.org>, David Rientjes <rientjes@...gle.com>, Joonsoo Kim <iamjoonsoo.kim@....com>, "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>, Ingo Molnar <mingo@...nel.org>, Josh Triplett <josh@...htriplett.org>, Andy Lutomirski <luto@...nel.org>, Nicolas Pitre <nicolas.pitre@...aro.org>, Tejun Heo <tj@...nel.org>, Daniel Mack <daniel@...que.org>, Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Sergey Senozhatsky <sergey.senozhatsky@...il.com>, Helge Deller <deller@....de>, Linux-MM <linux-mm@...ck.org>, Tycho Andersen <tycho@...ker.com>, LKML <linux-kernel@...r.kernel.org>, "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com> Subject: Re: [PATCH v3] mm: Add SLUB free list pointer obfuscation On Fri, Jul 7, 2017 at 10:06 AM, Christoph Lameter <cl@...ux.com> wrote: > On Fri, 7 Jul 2017, Kees Cook wrote: > >> If we also added a >0 offset, that would make things even less >> deterministic. Though I wonder if it would make the performance impact >> higher. The XOR patch right now is very light. > > There would be barely any performance impact if you keep the offset within > a cacheline since most objects start on a cacheline boundary. The > processor has to fetch the cacheline anyways. Sure, this seems like a nice additional bit of hardening, even if we're limited to a cacheline. I'd still want to protect the spray and index attacks though (which the XOR method covers), but we can do both. We should keep them distinct patches, though. If you'll Ack the XOR patch, I can poke at adding offset randomization? -Kees -- Kees Cook Pixel Security
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.