Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1621461
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH] mm: Add additional consistency check |
| Date | 2017-04-11 18:40 +0200 |
| Message-ID | <tv6ZI-Y3-1@gated-at.bofh.it> (permalink) |
| References | (9 earlier) <tv4Oe-85I-27@gated-at.bofh.it> <tv4XU-8aE-23@gated-at.bofh.it> <tv6Gm-QX-17@gated-at.bofh.it> <tv6Gm-QX-15@gated-at.bofh.it> <tv6Q3-Us-23@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Tue, Apr 11, 2017 at 9:23 AM, Christoph Lameter <cl@linux.com> wrote: > On Tue, 11 Apr 2017, Kees Cook wrote: > >> It seems that enabling the debug checks comes with a non-trivial >> performance impact. I'd like to see consistency checks by default so >> we can handle intentional heap corruption attacks better. This check >> isn't expensive... > > Its in a very hot code and frequently used code path. Yeah, absolutely. All the more reason to make sure the kernel can't be attacked through it. :) As with the automotive industry analogy[1] from Konstantin, we need to make sure Linux not only run fast and efficiently, but also fails gracefully by default. > Note also that these checks can be enabled and disabled at runtime for > each slab cache. Correct, but my understanding is that enabling them through the debug system ends up being much more expensive than this smaller check. The debug code is fairly comprehensive, but it's not been designed for efficient attack detection, etc. -Kees [1] http://kernsec.org/files/lss2015/giant-bags-of-mostly-water.pdf -- Kees Cook Pixel Security
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: [PATCH] mm: Add additional consistency check Kees Cook <keescook@chromium.org> - 2017-04-11 07:00 +0200
Re: [PATCH] mm: Add additional consistency check Michal Hocko <mhocko@kernel.org> - 2017-04-11 15:50 +0200
Re: [PATCH] mm: Add additional consistency check Kees Cook <keescook@chromium.org> - 2017-04-11 16:20 +0200
Re: [PATCH] mm: Add additional consistency check Michal Hocko <mhocko@kernel.org> - 2017-04-11 16:30 +0200
Re: [PATCH] mm: Add additional consistency check Kees Cook <keescook@chromium.org> - 2017-04-11 18:10 +0200
Re: [PATCH] mm: Add additional consistency check Kees Cook <keescook@chromium.org> - 2017-04-11 18:20 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-11 18:30 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-11 18:30 +0200
Re: [PATCH] mm: Add additional consistency check Kees Cook <keescook@chromium.org> - 2017-04-11 18:40 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-11 18:20 +0200
Re: [PATCH] mm: Add additional consistency check Michal Hocko <mhocko@kernel.org> - 2017-04-11 18:50 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-11 20:10 +0200
Re: [PATCH] mm: Add additional consistency check Michal Hocko <mhocko@kernel.org> - 2017-04-11 20:40 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-11 20:50 +0200
Re: [PATCH] mm: Add additional consistency check Michal Hocko <mhocko@kernel.org> - 2017-04-11 21:00 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-11 21:00 +0200
Re: [PATCH] mm: Add additional consistency check Michal Hocko <mhocko@kernel.org> - 2017-04-11 21:40 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-17 17:30 +0200
Re: [PATCH] mm: Add additional consistency check Michal Hocko <mhocko@kernel.org> - 2017-04-18 08:50 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-18 15:40 +0200
Re: [PATCH] mm: Add additional consistency check Christoph Lameter <cl@linux.com> - 2017-04-18 15:40 +0200
csiph-web