Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1678002

Re: [PATCH v2] mm: Add SLUB free list pointer obfuscation

Show all headers | View raw

On Thu, Jun 29, 2017 at 10:05 AM, Christoph Lameter <cl@linux.com> wrote:
> On Sun, 25 Jun 2017, Kees Cook wrote:
>
>> The difference gets lost in the noise, but if the above is sensible,
>> it's 0.07% slower. ;)
>
> Hmmm... These differences add up. Also in a repetative benchmark like that
> you do not see the impact that the additional cacheline use in the cpu
> cache has on larger workloads. Those may be pushed over the edge of l1 or
> l2 capacity at some point which then causes drastic regressions.

Even if that is true, it may be worth it to some people to have the
protection. Given that is significantly hampers a large class of heap
overflow attacks[1], I think it's an important change to have. I'm not
suggesting this be on by default, it's cleanly behind
CONFIG-controlled macros, and is very limited in scope. If you can Ack
it we can let system builders decide if they want to risk a possible
performance hit. I'm pretty sure most distros would like to have this
protection.

Thanks for looking it over!

-Kees

[1] http://resources.infosecinstitute.com/exploiting-linux-kernel-heap-corruptions-slub-allocator/

-- 
Kees Cook
Pixel Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2] mm: Add SLUB free list pointer obfuscation Kees Cook <keescook@chromium.org> - 2017-06-23 04:00 +0200
  Re: [PATCH v2] mm: Add SLUB free list pointer obfuscation Kees Cook <keescook@chromium.org> - 2017-06-25 22:00 +0200
    Re: [PATCH v2] mm: Add SLUB free list pointer obfuscation Christoph Lameter <cl@linux.com> - 2017-06-29 19:10 +0200
      Re: [PATCH v2] mm: Add SLUB free list pointer obfuscation Kees Cook <keescook@chromium.org> - 2017-06-29 19:50 +0200
        Re: [PATCH v2] mm: Add SLUB free list pointer obfuscation Rik van Riel <riel@redhat.com> - 2017-06-29 20:00 +0200
          Re: [kernel-hardening] Re: [PATCH v2] mm: Add SLUB free list pointer  obfuscation Tycho Andersen <tycho@docker.com> - 2017-06-29 20:00 +0200

csiph-web