Date: Thu, 08 Feb 2018 12:58:42 -0500 From: valdis.kletnieks@...edu To: Jann Horn <jannh@...gle.com> Cc: Matthew Wilcox <willy@...radead.org>, linux-mm@...ck.org, Kernel Hardening <kernel-hardening@...ts.openwall.com>, kernel list <linux-kernel@...r.kernel.org>, "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com> Subject: Re: [RFC] Warn the user when they could overflow mapcount On Thu, 08 Feb 2018 03:56:26 +0100, Jann Horn said: > I wouldn't be too surprised if there are more 32-bit overflows that > start being realistic once you put something on the order of terabytes > of memory into one machine, given that refcount_t is 32 bits wide - > for example, the i_count. See > https://bugs.chromium.org/p/project-zero/issues/detail?id=809 for an > example where, given a sufficiently high RLIMIT_MEMLOCK, it was > possible to overflow a 32-bit refcounter on a system with just ~32GiB > of free memory (minimum required to store 2^32 64-bit pointers). > > On systems with RAM on the order of terabytes, it's probably a good > idea to turn on refcount hardening to make issues like that > non-exploitable for now. I have at least 10 systems across the hall that have 3T of RAM on them across our various HPC clusters. So this is indeed no longer a hypothetical issue. Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.