From:
Arjan van de Ven <arjan-AT-infradead.org>
To:
Alan Cox <alan-AT-lxorguk.ukuu.org.uk>
Subject:
Re: [patch 0/5] Support for sanitization flag in low-level page
allocator
Date:
2009年5月23日 08:56:53 -0700
Message-ID:
<20090523085653.0ad217f8@infradead.org>
Cc:
"Larry H." <research-AT-subreption.com>, Ingo Molnar <mingo-AT-elte.hu>, Rik
van Riel <riel-AT-redhat.com>, linux-kernel-AT-vger.kernel.org, Linus Torvalds
<torvalds-AT-osdl.org>, linux-mm-AT-kvack.org, Ingo Molnar <mingo-AT-redhat.com>,
pageexec-AT-freemail.hu
Archive‑link:
Article
On 2009年5月23日 09:09:10 +0100 Alan Cox <alan@lxorguk.ukuu.org.uk> wrote: > > Enabling SLAB poisoning by default will be a bad idea > > Why ? > > > I looked for unused/re-usable flags too, but found none. It's > > interesting to see SLUB and SLOB have their own page flags. Did > > anybody oppose those when they were proposed? > > Certainly they were looked at - but the memory allocator is right at > the core of the system rather than an add on. > > > > Ditto - which is why I'm coming from the position of an "if we > > > free it clear it" option. If you need that kind of security the > > > cost should be more than acceptable - especially with modern > > > processors that can do cache bypass on the clears. > > > > Are you proposing that we should simply remove the confidential > > flags and just stick to the unconditional sanitization when the > > boot option is enabled? If positive, it will make things more > > simple and definitely is better than nothing. I would have (still) > > preferred the other old approach to be merged, but whatever works > > at this point. > > I am because > - its easy to merge > - its non controversial > - it meets the security good practice and means we don't miss any > alloc/free cases > - it avoid providing flags to help a trojan identify "interesting" > data to acquire > - modern cpu memory clearing can be very cheap .. and if we zero on free, we don't need to zero on allocate. While this is a little controversial, it does mean that at least part of the cost is just time-shifted, which means it'll not be TOO bad hopefully... -- Arjan van de Ven Intel Open Source Technology Centre For development, discussion and tips for power savings, visit http://www.lesswatts.org -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>