Date: Wed, 24 Oct 2018 17:03:01 +0300 From: Igor Stoppa <igor.stoppa@...il.com> To: Mathieu Desnoyers <mathieu.desnoyers@...icios.com> Cc: Mimi Zohar <zohar@...ux.vnet.ibm.com>, Kees Cook <keescook@...omium.org>, Matthew Wilcox <willy@...radead.org>, Dave Chinner <david@...morbit.com>, James Morris <jmorris@...ei.org>, Michal Hocko <mhocko@...nel.org>, kernel-hardening@...ts.openwall.com, linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org, igor stoppa <igor.stoppa@...wei.com>, Dave Hansen <dave.hansen@...ux.intel.com>, Jonathan Corbet <corbet@....net>, Laura Abbott <labbott@...hat.com>, Thomas Gleixner <tglx@...utronix.de>, Kate Stewart <kstewart@...uxfoundation.org>, "David S. Miller" <davem@...emloft.net>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Philippe Ombredanne <pombredanne@...b.com>, "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>, Josh Triplett <josh@...htriplett.org>, rostedt <rostedt@...dmis.org>, Lai Jiangshan <jiangshanlai@...il.com>, linux-kernel <linux-kernel@...r.kernel.org> Subject: Re: [PATCH 14/17] prmem: llist, hlist, both plain and rcu On 24/10/18 14:37, Mathieu Desnoyers wrote: > I could not find a description of the overall context of this patch > (e.g. a patch 00/17 ?) that would explain the attack vectors this aims > to protect against. Apologies, I have to admit I was a bit baffled about what to do: the patchset spans across several subsystems and I was reluctant at spamming all the mailing lists. I was hoping that by CC-ing kernel.org, the explicit recipients would get both the mail directly intended for them (as subsystem maintainers/supporters) and the rest. The next time I'll err in the opposite direction. In the meanwhile, please find the whole set here: https://www.openwall.com/lists/kernel-hardening/2018/10/23/3 > This might help figuring out whether this added complexity in the core > kernel is worth it. I hope it will. > Also, is it the right approach to duplicate existing APIs, or should we > rather hook into page fault handlers and let the kernel do those "shadow" > mappings under the hood ? This question is probably a good candidate for the small Q&A section I have in the 00/17. > Adding a new GFP flags for dynamic allocation, and a macro mapping to > a section attribute might suffice for allocation or definition of such > mostly-read-only/seldom-updated data. I think what you are proposing makes sense from a pure hardening standpoint. From a more defensive one, I'd rather minimise the chances of giving a free pass to an attacker. Maybe there is a better implementation of this, than what I have in mind. But, based on my current understanding of what you are describing, there would be few issues: 1) where would the pool go? The pool is a way to manage multiple vmas and express common property they share. Even before a vma is associated to the pool. 2) there would be more code that can seamlessly deal with both protected and regular data. Based on what? Some parameter, I suppose. That parameter would be the new target. If the code is "duplicated", as you say, the actual differences are baked in at compile time. The "duplication" would also allow to have always inlined functions for write-rare and leave more freedom to the compiler for their non-protected version. Besides, I think the separate wr version also makes it very clear, to the user of the API, that there will be a price to pay, in terms of performance. The more seamlessly alternative might make this price less obvious. -- igor
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.