From: Rich Felker <dalias@libc.org>
To: Matthew Wilcox <willy@infradead.org>
Cc: Kate Stewart <kstewart@linuxfoundation.org>,
Linux MIPS Mailing List <linux-mips@linux-mips.org>,
Jan Kara <jack@suse.cz>, linux-sh <linux-sh@vger.kernel.org>,
Ilya Smith <blackzert@gmail.com>,
Benjamin Herrenschmidt <benh@kernel.crashing.org>,
Bhupesh Sharma <bhsharma@redhat.com>,
Heiko Carstens <heiko.carstens@de.ibm.com>,
Michal Hocko <mhocko@kernel.org>, Linux-MM <linux-mm@kvack.org>,
Paul Mackerras <paulus@samba.org>,
Deepa Dinamani <deepa.kernel@gmail.com>,
"H. Peter Anvin" <hpa@zytor.com>,
sparclinux <sparclinux@vger.kernel.org>,
linux-ia64@vger.kernel.org,
Dan Williams <dan.j.williams@intel.com>,
Andrea Arcangeli <aarcange@redhat.com>,
linux-s390 <linux-s390@vger.kernel.org>,
Yoshinori Sato <ysato@users.sourceforge.jp>,
Michael Ellerman <mpe@ellerman.id.au>,
Helge Deller <deller@gmx.de>, X86 ML <x86@kernel.org>,
Hugh Dickins <hughd@google.com>,
Russell King <li
Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.
Date: Tue, 27 Mar 2018 20:00:25 -0400 [thread overview]
Message-ID: <20180328000025.GM1436@brightrain.aerifal.cx> (raw)
In-Reply-To: <20180327234904.GA27734@bombadil.infradead.org>
On Tue, Mar 27, 2018 at 04:49:04PM -0700, Matthew Wilcox wrote:
> On Tue, Mar 27, 2018 at 03:53:53PM -0700, Kees Cook wrote:
> > I agree: pushing this off to libc leaves a lot of things unprotected.
> > I think this should live in the kernel. The question I have is about
> > making it maintainable/readable/etc.
> >
> > The state-of-the-art for ASLR is moving to finer granularity (over
> > just base-address offset), so I'd really like to see this supported in
> > the kernel. We'll be getting there for other things in the future, and
> > I'd like to have a working production example for researchers to
> > study, etc.
>
> One thing we need is to limit the fragmentation of this approach.
> Even on 64-bit systems, we can easily get into a situation where there isn't
> space to map a contiguous terabyte.
The default limit of only 65536 VMAs will also quickly come into play
if consecutive anon mmaps don't get merged. Of course this can be
raised, but it has significant resource and performance (fork) costs.
Rich
WARNING: multiple messages have this Message-ID (diff)
From: Rich Felker <dalias@libc.org>
To: Matthew Wilcox <willy@infradead.org>
Cc: Kees Cook <keescook@chromium.org>,
Ilya Smith <blackzert@gmail.com>,
Michal Hocko <mhocko@kernel.org>,
Richard Henderson <rth@twiddle.net>,
ink@jurassic.park.msu.ru, mattst88@gmail.com,
Vineet Gupta <vgupta@synopsys.com>,
Russell King <linux@armlinux.org.uk>,
Tony Luck <tony.luck@intel.com>,
Fenghua Yu <fenghua.yu@intel.com>,
Ralf Baechle <ralf@linux-mips.org>,
"James E.J. Bottomley" <jejb@parisc-linux.org>,
Helge Deller <deller@gmx.de>,
Benjamin Herrenschmidt <benh@kernel.crashing.org>,
Paul Mackerras <paulus@samba.org>,
Michael Ellerman <mpe@ellerman.id.au>,
Martin Schwidefsky <schwidefsky@de.ibm.com>,
Heiko Carstens <heiko.carstens@de.ibm.com>,
Yoshinori Sato <ysato@users.sourceforge.jp>,
"David S. Miller" <davem@davemloft.net>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
X86 ML <x86@kernel.org>,
nyc@holomorphy.com, Al Viro <viro@zeniv.linux.org.uk>,
Arnd Bergmann <arnd@arndb.de>,
Greg KH <gregkh@linuxfoundation.org>,
Deepa Dinamani <deepa.kernel@gmail.com>,
Hugh Dickins <hughd@google.com>,
Kate Stewart <kstewart@linuxfoundation.org>,
Philippe Ombredanne <pombredanne@nexb.com>,
Andrew Morton <akpm@linux-foundation.org>,
Steve Capper <steve.capper@arm.com>,
Punit Agrawal <punit.agrawal@arm.com>,
"Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>,
Nick Piggin <npiggin@gmail.com>,
Bhupesh Sharma <bhsharma@redhat.com>,
Rik van Riel <riel@redhat.com>,
nitin.m.gupta@oracle.com,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Dan Williams <dan.j.williams@intel.com>, Jan Kara <jack@suse.cz>,
Ross Zwisler <ross.zwisler@linux.intel.com>,
Jerome Glisse <jglisse@redhat.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Oleg Nesterov <oleg@redhat.com>,
linux-alpha@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
linux-snps-arc@lists.infradead.org, linux-ia64@vger.kernel.org,
linux-metag@vger.kernel.org,
Linux MIPS Mailing List <linux-mips@linux-mips.org>,
linux-parisc <linux-parisc@vger.kernel.org>,
PowerPC <linuxppc-dev@lists.ozlabs.org>,
linux-s390 <linux-s390@vger.kernel.org>,
linux-sh <linux-sh@vger.kernel.org>,
sparclinux <sparclinux@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>
Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.
Date: Tue, 27 Mar 2018 20:00:25 -0400 [thread overview]
Message-ID: <20180328000025.GM1436@brightrain.aerifal.cx> (raw)
In-Reply-To: <20180327234904.GA27734@bombadil.infradead.org>
On Tue, Mar 27, 2018 at 04:49:04PM -0700, Matthew Wilcox wrote:
> On Tue, Mar 27, 2018 at 03:53:53PM -0700, Kees Cook wrote:
> > I agree: pushing this off to libc leaves a lot of things unprotected.
> > I think this should live in the kernel. The question I have is about
> > making it maintainable/readable/etc.
> >
> > The state-of-the-art for ASLR is moving to finer granularity (over
> > just base-address offset), so I'd really like to see this supported in
> > the kernel. We'll be getting there for other things in the future, and
> > I'd like to have a working production example for researchers to
> > study, etc.
>
> One thing we need is to limit the fragmentation of this approach.
> Even on 64-bit systems, we can easily get into a situation where there isn't
> space to map a contiguous terabyte.
The default limit of only 65536 VMAs will also quickly come into play
if consecutive anon mmaps don't get merged. Of course this can be
raised, but it has significant resource and performance (fork) costs.
Rich
WARNING: multiple messages have this Message-ID (diff)
From: dalias@libc.org (Rich Felker)
To: linux-snps-arc@lists.infradead.org
Subject: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.
Date: Tue, 27 Mar 2018 20:00:25 -0400 [thread overview]
Message-ID: <20180328000025.GM1436@brightrain.aerifal.cx> (raw)
In-Reply-To: <20180327234904.GA27734@bombadil.infradead.org>
On Tue, Mar 27, 2018@04:49:04PM -0700, Matthew Wilcox wrote:
> On Tue, Mar 27, 2018@03:53:53PM -0700, Kees Cook wrote:
> > I agree: pushing this off to libc leaves a lot of things unprotected.
> > I think this should live in the kernel. The question I have is about
> > making it maintainable/readable/etc.
> >
> > The state-of-the-art for ASLR is moving to finer granularity (over
> > just base-address offset), so I'd really like to see this supported in
> > the kernel. We'll be getting there for other things in the future, and
> > I'd like to have a working production example for researchers to
> > study, etc.
>
> One thing we need is to limit the fragmentation of this approach.
> Even on 64-bit systems, we can easily get into a situation where there isn't
> space to map a contiguous terabyte.
The default limit of only 65536 VMAs will also quickly come into play
if consecutive anon mmaps don't get merged. Of course this can be
raised, but it has significant resource and performance (fork) costs.
Rich
WARNING: multiple messages have this Message-ID (diff)
From: Rich Felker <dalias@libc.org>
To: Matthew Wilcox <willy@infradead.org>
Cc: Kate Stewart <kstewart@linuxfoundation.org>,
Linux MIPS Mailing List <linux-mips@linux-mips.org>,
Jan Kara <jack@suse.cz>, linux-sh <linux-sh@vger.kernel.org>,
Ilya Smith <blackzert@gmail.com>,
Benjamin Herrenschmidt <benh@kernel.crashing.org>,
Bhupesh Sharma <bhsharma@redhat.com>,
Heiko Carstens <heiko.carstens@de.ibm.com>,
Michal Hocko <mhocko@kernel.org>, Linux-MM <linux-mm@kvack.org>,
Paul Mackerras <paulus@samba.org>,
Deepa Dinamani <deepa.kernel@gmail.com>,
"H. Peter Anvin" <hpa@zytor.com>,
sparclinux <sparclinux@vger.kernel.org>,
linux-ia64@vger.kernel.org,
Dan Williams <dan.j.williams@intel.com>,
Andrea Arcangeli <aarcange@redhat.com>,
linux-s390 <linux-s390@vger.kernel.org>,
Yoshinori Sato <ysato@users.sourceforge.jp>,
Michael Ellerman <mpe@ellerman.id.au>,
Helge Deller <deller@gmx.de>, X86 ML <x86@kernel.org>,
Hugh Dickins <hughd@google.com>, Russell King <li>
Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.
Date: Tue, 27 Mar 2018 20:00:25 -0400 [thread overview]
Message-ID: <20180328000025.GM1436@brightrain.aerifal.cx> (raw)
In-Reply-To: <20180327234904.GA27734@bombadil.infradead.org>
On Tue, Mar 27, 2018 at 04:49:04PM -0700, Matthew Wilcox wrote:
> On Tue, Mar 27, 2018 at 03:53:53PM -0700, Kees Cook wrote:
> > I agree: pushing this off to libc leaves a lot of things unprotected.
> > I think this should live in the kernel. The question I have is about
> > making it maintainable/readable/etc.
> >
> > The state-of-the-art for ASLR is moving to finer granularity (over
> > just base-address offset), so I'd really like to see this supported in
> > the kernel. We'll be getting there for other things in the future, and
> > I'd like to have a working production example for researchers to
> > study, etc.
>
> One thing we need is to limit the fragmentation of this approach.
> Even on 64-bit systems, we can easily get into a situation where there isn't
> space to map a contiguous terabyte.
The default limit of only 65536 VMAs will also quickly come into play
if consecutive anon mmaps don't get merged. Of course this can be
raised, but it has significant resource and performance (fork) costs.
Rich
next prev parent reply other threads:[~2018-03-28 0:00 UTC|newest]
Thread overview: 185+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-22 16:36 [RFC PATCH v2 0/2] Randomization of address chosen by mmap Ilya Smith
2018-03-22 16:36 ` Ilya Smith
2018-03-22 16:36 ` Ilya Smith
2018-03-22 16:36 ` [RFC PATCH v2 1/2] " Ilya Smith
2018-03-22 16:36 ` Ilya Smith
2018-03-22 16:36 ` Ilya Smith
2018-03-22 20:53 ` Andrew Morton
2018-03-22 20:53 ` Andrew Morton
2018-03-22 20:53 ` Andrew Morton
2018-03-22 20:53 ` Andrew Morton
2018-03-23 17:43 ` Ilya Smith
2018-03-23 17:43 ` Ilya Smith
2018-03-23 17:43 ` Ilya Smith
2018-03-23 17:43 ` Ilya Smith
2018-03-23 17:43 ` Ilya Smith
2018-03-23 17:43 ` Ilya Smith
2018-03-22 16:36 ` [RFC PATCH v2 2/2] Architecture defined limit on memory region random shift Ilya Smith
2018-03-22 16:36 ` Ilya Smith
2018-03-22 16:36 ` Ilya Smith
2018-03-22 20:54 ` Andrew Morton
2018-03-22 20:54 ` Andrew Morton
2018-03-22 20:54 ` Andrew Morton
2018-03-22 20:54 ` Andrew Morton
2018-03-23 17:48 ` Ilya Smith
2018-03-23 17:48 ` Ilya Smith
2018-03-23 17:49 ` Ilya Smith
2018-03-23 17:49 ` Ilya Smith
2018-03-23 17:49 ` Ilya Smith
2018-03-23 17:49 ` Ilya Smith
2018-03-23 17:49 ` Ilya Smith
2018-03-23 17:49 ` Ilya Smith
2018-03-22 20:57 ` [RFC PATCH v2 0/2] Randomization of address chosen by mmap Andrew Morton
2018-03-22 20:57 ` Andrew Morton
2018-03-22 20:57 ` Andrew Morton
2018-03-22 20:57 ` Andrew Morton
2018-03-23 17:25 ` Ilya Smith
2018-03-23 17:25 ` Ilya Smith
2018-03-23 17:25 ` Ilya Smith
2018-03-23 17:25 ` Ilya Smith
2018-03-23 17:25 ` Ilya Smith
2018-03-23 17:25 ` Ilya Smith
2018-03-23 12:48 ` Matthew Wilcox
2018-03-23 12:48 ` Matthew Wilcox
2018-03-23 12:48 ` Matthew Wilcox
2018-03-23 12:48 ` Matthew Wilcox
2018-03-23 17:55 ` Ilya Smith
2018-03-23 17:55 ` Ilya Smith
2018-03-23 17:55 ` Ilya Smith
2018-03-23 17:55 ` Ilya Smith
2018-03-23 17:55 ` Ilya Smith
2018-03-23 17:55 ` Ilya Smith
2018-03-26 8:46 ` Michal Hocko
2018-03-26 8:46 ` Michal Hocko
2018-03-26 8:46 ` Michal Hocko
2018-03-26 8:46 ` Michal Hocko
2018-03-26 8:46 ` Michal Hocko
2018-03-26 19:45 ` Ilya Smith
2018-03-26 19:45 ` Ilya Smith
2018-03-26 19:45 ` Ilya Smith
2018-03-26 19:45 ` Ilya Smith
2018-03-26 19:45 ` Ilya Smith
2018-03-26 19:45 ` Ilya Smith
2018-03-27 7:24 ` Michal Hocko
2018-03-27 7:24 ` Michal Hocko
2018-03-27 7:24 ` Michal Hocko
2018-03-27 7:24 ` Michal Hocko
2018-03-27 7:24 ` Michal Hocko
2018-03-27 13:51 ` Ilya Smith
2018-03-27 13:51 ` Ilya Smith
2018-03-27 13:51 ` Ilya Smith
2018-03-27 13:51 ` Ilya Smith
2018-03-27 13:51 ` Ilya Smith
2018-03-27 13:51 ` Ilya Smith
2018-03-27 14:38 ` Michal Hocko
2018-03-27 14:38 ` Michal Hocko
2018-03-27 14:38 ` Michal Hocko
2018-03-27 14:38 ` Michal Hocko
2018-03-27 14:38 ` Michal Hocko
2018-03-28 18:47 ` Ilya Smith
2018-03-28 18:47 ` Ilya Smith
2018-03-28 18:47 ` Ilya Smith
2018-03-28 18:47 ` Ilya Smith
2018-03-28 18:47 ` Ilya Smith
2018-03-28 18:47 ` Ilya Smith
2018-03-27 22:16 ` Theodore Y. Ts'o
2018-03-27 22:16 ` Theodore Y. Ts'o
2018-03-27 22:16 ` Theodore Y. Ts'o
2018-03-27 22:16 ` Theodore Y. Ts'o
2018-03-27 22:16 ` Theodore Y. Ts'o
2018-03-27 23:58 ` Rich Felker
2018-03-27 23:58 ` Rich Felker
2018-03-27 23:58 ` Rich Felker
2018-03-27 23:58 ` Rich Felker
2018-03-28 18:48 ` Ilya Smith
2018-03-28 18:48 ` Ilya Smith
2018-03-28 18:48 ` Ilya Smith
2018-03-28 18:48 ` Ilya Smith
2018-03-28 18:48 ` Ilya Smith
2018-03-28 18:48 ` Ilya Smith
2018-03-27 22:53 ` Kees Cook
2018-03-27 22:53 ` Kees Cook
2018-03-27 22:53 ` Kees Cook
2018-03-27 22:53 ` Kees Cook
2018-03-27 22:53 ` Kees Cook
2018-03-27 23:49 ` Matthew Wilcox
2018-03-27 23:49 ` Matthew Wilcox
2018-03-27 23:49 ` Matthew Wilcox
2018-03-27 23:49 ` Matthew Wilcox
2018-03-27 23:57 ` Kees Cook
2018-03-27 23:57 ` Kees Cook
2018-03-27 23:57 ` Kees Cook
2018-03-27 23:57 ` Kees Cook
2018-03-28 0:00 ` Rich Felker [this message]
2018-03-28 0:00 ` Rich Felker
2018-03-28 0:00 ` Rich Felker
2018-03-28 0:00 ` Rich Felker
2018-03-28 21:07 ` Luck, Tony
2018-03-28 21:07 ` Luck, Tony
2018-03-28 21:07 ` Luck, Tony
2018-03-28 21:07 ` Luck, Tony
2018-03-28 21:07 ` Luck, Tony
2018-04-03 0:11 ` Ilya Smith
2018-04-03 0:11 ` Ilya Smith
2018-04-03 0:11 ` Ilya Smith
2018-04-03 0:11 ` Ilya Smith
2018-04-03 0:11 ` Ilya Smith
2018-04-03 0:11 ` Ilya Smith
2018-03-28 21:07 ` Ilya Smith
2018-03-28 21:07 ` Ilya Smith
2018-03-28 21:07 ` Ilya Smith
2018-03-28 21:07 ` Ilya Smith
2018-03-28 21:07 ` Ilya Smith
2018-03-23 18:00 ` Rich Felker
2018-03-23 18:00 ` Rich Felker
2018-03-23 18:00 ` Rich Felker
2018-03-23 18:00 ` Rich Felker
2018-03-23 18:00 ` Rich Felker
2018-03-23 19:06 ` Matthew Wilcox
2018-03-23 19:06 ` Matthew Wilcox
2018-03-23 19:06 ` Matthew Wilcox
2018-03-23 19:06 ` Matthew Wilcox
2018-03-23 19:16 ` Rich Felker
2018-03-23 19:16 ` Rich Felker
2018-03-23 19:16 ` Rich Felker
2018-03-23 19:16 ` Rich Felker
2018-03-23 19:16 ` Rich Felker
2018-03-23 19:29 ` Matthew Wilcox
2018-03-23 19:29 ` Matthew Wilcox
2018-03-23 19:29 ` Matthew Wilcox
2018-03-23 19:29 ` Matthew Wilcox
2018-03-23 19:35 ` Rich Felker
2018-03-23 19:35 ` Rich Felker
2018-03-23 19:35 ` Rich Felker
2018-03-23 19:35 ` Rich Felker
2018-03-23 19:35 ` Rich Felker
2018-03-28 4:50 ` Rob Landley
2018-03-28 4:50 ` Rob Landley
2018-03-28 4:50 ` Rob Landley
2018-03-28 4:50 ` Rob Landley
2018-03-28 4:50 ` Rob Landley
2018-03-30 7:55 ` Pavel Machek
2018-03-30 7:55 ` Pavel Machek
2018-03-30 7:55 ` Pavel Machek
2018-03-30 7:55 ` Pavel Machek
2018-03-30 9:07 ` Ilya Smith
2018-03-30 9:07 ` Ilya Smith
2018-03-30 9:07 ` Ilya Smith
2018-03-30 9:07 ` Ilya Smith
2018-03-30 9:07 ` Ilya Smith
2018-03-30 9:07 ` Ilya Smith
2018-03-30 9:57 ` Pavel Machek
2018-03-30 9:57 ` Pavel Machek
2018-03-30 9:57 ` Pavel Machek
2018-03-30 9:57 ` Pavel Machek
2018-03-30 11:10 ` Ilya Smith
2018-03-30 11:10 ` Ilya Smith
2018-03-30 11:10 ` Ilya Smith
2018-03-30 11:10 ` Ilya Smith
2018-03-30 11:10 ` Ilya Smith
2018-03-30 11:10 ` Ilya Smith
2018-03-30 13:33 ` Rich Felker
2018-03-30 13:33 ` Rich Felker
2018-03-30 13:33 ` Rich Felker
2018-03-30 13:33 ` Rich Felker
2018-03-30 13:33 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180328000025.GM1436@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=aarcange@redhat.com \
--cc=benh@kernel.crashing.org \
--cc=bhsharma@redhat.com \
--cc=blackzert@gmail.com \
--cc=dan.j.williams@intel.com \
--cc=deepa.kernel@gmail.com \
--cc=deller@gmx.de \
--cc=heiko.carstens@de.ibm.com \
--cc=hpa@zytor.com \
--cc=hughd@google.com \
--cc=jack@suse.cz \
--cc=kstewart@linuxfoundation.org \
--cc=linux-ia64@vger.kernel.org \
--cc=linux-mips@linux-mips.org \
--cc=linux-mm@kvack.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux-sh@vger.kernel.org \
--cc=mhocko@kernel.org \
--cc=mpe@ellerman.id.au \
--cc=paulus@samba.org \
--cc=sparclinux@vger.kernel.org \
--cc=willy@infradead.org \
--cc=x86@kernel.org \
--cc=ysato@users.sourceforge.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.