From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751938AbcFUTsH (ORCPT ); Tue, 21 Jun 2016 15:48:07 -0400 Received: from mout.kundenserver.de ([217.72.192.75]:62056 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750701AbcFUTru convert rfc822-to-8bit (ORCPT ); Tue, 21 Jun 2016 15:47:50 -0400 From: Arnd Bergmann To: Kees Cook Cc: Andy Lutomirski , "x86@kernel.org" , LKML , linux-arch , Borislav Petkov , Nadav Amit , Brian Gerst , "kernel-hardening@lists.openwall.com" , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Date: Tue, 21 Jun 2016 21:47:44 +0200 Message-ID: <6248429.A4IJrfgOW3@wuerfel> User-Agent: KMail/5.1.3 (Linux/4.4.0-22-generic; KDE/5.18.0; x86_64; ; ) In-Reply-To: References: <13212319.WrhLzgRA6Z@wuerfel> MIME-Version: 1.0 Content-Transfer-Encoding: 8BIT Content-Type: text/plain; charset="iso-8859-1" X-Provags-ID: V03:K0:NZ2R4ZwpY4rnl8Xw6YwR8gzdSZjHd+1d4o3byTohKK9jkfbJa+S SJ33raan13OhnZEpJi3WZ3KR5AH2o2yuvP20O4IaoVu7CMNuBk546ZHOqIxgD4hp2D/+1+b HbY+i0k7HK90i24ZK3zblh1SGS5AOaB7gati5GPN+0xBaIdd7Q7ouXIJg5xn0kQfNJwL91K e4mzhx4POYTd2jLKZaYWw== X-UI-Out-Filterresults: notjunk:1;V01:K0:F01F3yuY9HM=:mZeaW/F1UFh0/NVm+tHeIY t6cbksxv3/GfqnC9CW3URJS28Q1/sS8ipso1EqgCZjfRk5hU1bbE6YXuGjckuJQ4OjDf0CL9w 3T+cVbz1rZhZDAsa1S04DrcIv2OjLQxM1d1/6Q0AF4wIEtEh+OOtMD1Vu7FF8JIrwBeaRZ+w7 MfyM3hsvwOd2hnw+bTzM6kCX+N91+d2E8jEIPkhiQ4bp9Lzyh2l6KDOd5Vudm0QYsJyrLsWW5 FL8IA1OfF05+yP3CvAH/+DHRjViXWhybZ3NQbOTNVYUXj9lpWn8/YdK5cSFfOcBd439xwG9hR MFNJPOBxtZhsKV7sFEqT+bZccJmvMYhO/30dIP0fG7p0ircobWj9D16A5pw0MCI037of6/pub QMmD4ytYjWgJs5eY63smuRMZZfG5iZgimVc/CxYZrTBRBMPyG5WeGChngJratyhu1WZtRSN8b px5mhxhbndbvPMZF/wgKmLPVLT0hOtfKE5Cz1CseHHNBnhi8pwK9vAhtCQ8dPxbvz+JJgPim2 X3BOhZtHkfwO49go9nI2xZ3q+bsfewJ6AGoLfXiXxKZByNsd3yoAJGXKrZsvzEQPBU4Yduv97 /ljqdcwlyePA1uzdnc4SHU7Yx+Dr9Q40zgXqRLR5gCyWeERT3jr3/bDpO2pKbS/Nv5MH0FxWG APcoSgij1iUcvHOw85gqY2ZyXJr/2gfZManSsxQjcF5P6MIL1kvZ/1wDncOKjo1GP+pLzVvvL BEX9dDdwM5WB88kn Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tuesday, June 21, 2016 10:16:21 AM CEST Kees Cook wrote: > On Tue, Jun 21, 2016 at 2:24 AM, Arnd Bergmann wrote: > > On Monday, June 20, 2016 4:43:30 PM CEST Andy Lutomirski wrote: > >> > >> On my laptop, this adds about 1.5µs of overhead to task creation, > >> which seems to be mainly caused by vmalloc inefficiently allocating > >> individual pages even when a higher-order page is available on the > >> freelist. > > > > Would it help to have a fixed virtual address for the stack instead > > and map the current stack to that during a task switch, similar to > > how we handle fixmap pages? > > > > That would of course trade the allocation overhead for a task switch > > overhead, which may be better or worse. It would also give "current" > > a constant address, which may give a small performance advantage > > but may also introduce a new attack vector unless we randomize it > > again. > > Right: we don't want a fixed address. That makes attacks WAY easier. Do we care about making the address more random then? When I look at /proc/vmallocinfo, I see that allocations are all using consecutive addresses, so if you can figure out the virtual address of the stack for one process that would give you a good chance of guessing the address for the next pid. Arnd From mboxrd@z Thu Jan 1 00:00:00 1970 From: Arnd Bergmann Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Date: Tue, 21 Jun 2016 21:47:44 +0200 Message-ID: <6248429.A4IJrfgOW3@wuerfel> References: <13212319.WrhLzgRA6Z@wuerfel> Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: In-Reply-To: To: Kees Cook Cc: Andy Lutomirski , "x86@kernel.org" , LKML , linux-arch , Borislav Petkov , Nadav Amit , Brian Gerst , "kernel-hardening@lists.openwall.com" , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens List-Id: linux-arch.vger.kernel.org On Tuesday, June 21, 2016 10:16:21 AM CEST Kees Cook wrote: > On Tue, Jun 21, 2016 at 2:24 AM, Arnd Bergmann wrote: > > On Monday, June 20, 2016 4:43:30 PM CEST Andy Lutomirski wrote: > >> > >> On my laptop, this adds about 1.5=B5s of overhead to task creation, > >> which seems to be mainly caused by vmalloc inefficiently allocating > >> individual pages even when a higher-order page is available on the > >> freelist. > > > > Would it help to have a fixed virtual address for the stack instead > > and map the current stack to that during a task switch, similar to > > how we handle fixmap pages? > > > > That would of course trade the allocation overhead for a task switch > > overhead, which may be better or worse. It would also give "current" > > a constant address, which may give a small performance advantage > > but may also introduce a new attack vector unless we randomize it > > again. >=20 > Right: we don't want a fixed address. That makes attacks WAY easier. Do we care about making the address more random then? When I look at /proc/vmallocinfo, I see that allocations are all using consecutive addresses, so if you can figure out the virtual address of the stack for one process that would give you a good chance of guessing the address for the next pid. Arnd From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com From: Arnd Bergmann Date: Tue, 21 Jun 2016 21:47:44 +0200 Message-ID: <6248429.A4IJrfgOW3@wuerfel> In-Reply-To: References: <13212319.WrhLzgRA6Z@wuerfel> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="iso-8859-1" Subject: [kernel-hardening] Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Kees Cook Cc: Andy Lutomirski , "x86@kernel.org" , LKML , linux-arch , Borislav Petkov , Nadav Amit , Brian Gerst , "kernel-hardening@lists.openwall.com" , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens List-ID: On Tuesday, June 21, 2016 10:16:21 AM CEST Kees Cook wrote: > On Tue, Jun 21, 2016 at 2:24 AM, Arnd Bergmann wrote: > > On Monday, June 20, 2016 4:43:30 PM CEST Andy Lutomirski wrote: > >> > >> On my laptop, this adds about 1.5=B5s of overhead to task creation, > >> which seems to be mainly caused by vmalloc inefficiently allocating > >> individual pages even when a higher-order page is available on the > >> freelist. > > > > Would it help to have a fixed virtual address for the stack instead > > and map the current stack to that during a task switch, similar to > > how we handle fixmap pages? > > > > That would of course trade the allocation overhead for a task switch > > overhead, which may be better or worse. It would also give "current" > > a constant address, which may give a small performance advantage > > but may also introduce a new attack vector unless we randomize it > > again. >=20 > Right: we don't want a fixed address. That makes attacks WAY easier. Do we care about making the address more random then? When I look at /proc/vmallocinfo, I see that allocations are all using consecutive addresses, so if you can figure out the virtual address of the stack for one process that would give you a good chance of guessing the address for the next pid. Arnd