Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1651971

Re: [PATCH 0/3] ipc subsystem refcounter conversions

Show all headers | View raw

On Fri, Mar 3, 2017 at 4:23 PM, Andrew Morton <akpm@linux-foundation.org> wrote:
> On Mon, 20 Feb 2017 13:29:46 +0200 Elena Reshetova <elena.reshetova@intel.com> wrote:
>
>> Now when new refcount_t type and API are finally merged
>> (see include/linux/refcount.h), the following
>> patches convert various refcounters in the ipc susystem from atomic_t
>> to refcount_t. By doing this we prevent intentional or accidental
>> underflows or overflows that can led to use-after-free vulnerabilities.
>>
>> The below patches are fully independent and can be cherry-picked separately.
>> Since we convert all kernel subsystems in the same fashion, resulting
>> in about 300 patches, we have to group them for sending at least in some
>> fashion to be manageable. Please excuse the long cc list.
>
> Again, the refcount_t operations are much more expensive than the bare
> atomic_t operations.  I'm reluctant to merge any of these conversions

Since Manfred did a recent refactor of IPC RCU, and the refcount usage
is minimal, it seemed a good time to ask after these patches again.
(And send an updated one for the refactor.)

> without either
>
> a) a convincing demonstration that the performance impact is
>    sufficiently small (ie: unmeasurable) or

I've sent a few versions of a much faster refcount implementation
which has no measurable difference to atomic_t operations (based on
the PaX implementation). Getting more eyes on that would be nice; I'll
include you on CC when I send the next version.

> b) a compile-time option to disable the refcount_t operations (make
>    them generate the same code as the bare atomic_t ops).  Along with
>    some suitably reliable means of preventing people from accidentally
>    enabling the debug code in production builds.

Since the speed-ups will likely be arch-specific, should my proposed
CONFIG_FAST_REFCOUNT be made arch-indep when no arch-specific
implementation available (via totally unchecked atomic_t ops)? i.e.:

FAST_REFCOUNT=n: use function-based refcount_t with cmpxvhg and
full-verification
FAST_REFCOUNT=y without arch-specific implementation: use atomic_t
with no verification (i.e. no functional change from now)
FAST_REFCOUNT=y with arch-specific implementation: use atomic_t with
overflow protection

which means FAST_REFCOUNT would need to be default-on so that mm,
block, net users will remain happy.

Does that sound reasonable?

-Kees

-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH 0/3] ipc subsystem refcounter conversions Kees Cook <keescook@chromium.org> - 2017-05-27 22:00 +0200
  Re: [PATCH 0/3] ipc subsystem refcounter conversions Christoph Hellwig <hch@infradead.org> - 2017-05-29 10:40 +0200
    Re: [PATCH 0/3] ipc subsystem refcounter conversions ebiederm@xmission.com (Eric W. Biederman) - 2017-05-29 11:20 +0200
      Re: [PATCH 0/3] ipc subsystem refcounter conversions Peter Zijlstra <peterz@infradead.org> - 2017-05-29 12:30 +0200
        Re: [PATCH 0/3] ipc subsystem refcounter conversions ebiederm@xmission.com (Eric W. Biederman) - 2017-05-29 13:00 +0200
          Re: [PATCH 0/3] ipc subsystem refcounter conversions ebiederm@xmission.com (Eric W. Biederman) - 2017-05-29 13:40 +0200
            Re: [PATCH 0/3] ipc subsystem refcounter conversions ebiederm@xmission.com (Eric W. Biederman) - 2017-05-29 13:50 +0200
              Re: [PATCH 0/3] ipc subsystem refcounter conversions Peter Zijlstra <peterz@infradead.org> - 2017-05-29 14:30 +0200
                Re: [PATCH 0/3] ipc subsystem refcounter conversions Peter Zijlstra <peterz@infradead.org> - 2017-05-29 17:50 +0200
          Re: [PATCH 0/3] ipc subsystem refcounter conversions Peter Zijlstra <peterz@infradead.org> - 2017-05-29 14:20 +0200

csiph-web