From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752790AbcFUSMf (ORCPT ); Tue, 21 Jun 2016 14:12:35 -0400 Received: from mail-lf0-f44.google.com ([209.85.215.44]:36210 "EHLO mail-lf0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751530AbcFUSMd (ORCPT ); Tue, 21 Jun 2016 14:12:33 -0400 MIME-Version: 1.0 In-Reply-To: References: From: Kees Cook Date: Tue, 21 Jun 2016 11:12:31 -0700 X-Google-Sender-Auth: _tHGzom8GI7W8uxpAgLSm_qY6qk Message-ID: Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Andy Lutomirski , Herbert Xu Cc: Linus Torvalds , Andy Lutomirski , "the arch/x86 maintainers" , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Brian Gerst , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jun 21, 2016 at 10:27 AM, Andy Lutomirski wrote: > On Tue, Jun 21, 2016 at 10:16 AM, Linus Torvalds > wrote: >> On Tue, Jun 21, 2016 at 9:45 AM, Andy Lutomirski wrote: >>> >>> So I'm leaning toward fewer cache entries per cpu, maybe just one. >>> I'm all for making it a bit faster, but I think we should weigh that >>> against increasing memory usage too much and thus scaring away the >>> embedded folks. >> >> I don't think the embedded folks will be scared by a per-cpu cache, if >> it's just one or two entries. And I really do think that even just >> one or two entries will indeed catch a lot of the cases. >> >> And yes, fork+execve() is too damn expensive in page table build-up >> and tear-down. I'm not sure why bash doesn't do vfork+exec for when it >> has to wait for the process anyway, but it doesn't seem to do that. >> > > I don't know about bash, but glibc very recently fixed a long-standing > but in posix_spawn and started using clone() in a sensible manner for > this. > > FWIW, it may be a while before this can be enabled in distro kernels. > There are some code paths (*cough* crypto users *cough*) that think > that calling sg_init_one with a stack address is a reasonable thing to > do, and it doesn't work with a vmalloced stack. grsecurity works ... O_o ... Why does it not work on a vmalloced stack?? > around this by using a real lowmem higher-order stack, aliasing it > into vmalloc space, and arranging for virt_to_phys to backtrack the > alias, but eww. I think I'd rather find and fix the bugs, assuming > they're straightforward. Yeah. That's ugly. -Kees -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Date: Tue, 21 Jun 2016 11:12:31 -0700 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Andy Lutomirski , Herbert Xu Cc: Linus Torvalds , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Brian Gerst , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens List-Id: linux-arch.vger.kernel.org On Tue, Jun 21, 2016 at 10:27 AM, Andy Lutomirski wrote: > On Tue, Jun 21, 2016 at 10:16 AM, Linus Torvalds > wrote: >> On Tue, Jun 21, 2016 at 9:45 AM, Andy Lutomirski wrote: >>> >>> So I'm leaning toward fewer cache entries per cpu, maybe just one. >>> I'm all for making it a bit faster, but I think we should weigh that >>> against increasing memory usage too much and thus scaring away the >>> embedded folks. >> >> I don't think the embedded folks will be scared by a per-cpu cache, if >> it's just one or two entries. And I really do think that even just >> one or two entries will indeed catch a lot of the cases. >> >> And yes, fork+execve() is too damn expensive in page table build-up >> and tear-down. I'm not sure why bash doesn't do vfork+exec for when it >> has to wait for the process anyway, but it doesn't seem to do that. >> > > I don't know about bash, but glibc very recently fixed a long-standing > but in posix_spawn and started using clone() in a sensible manner for > this. > > FWIW, it may be a while before this can be enabled in distro kernels. > There are some code paths (*cough* crypto users *cough*) that think > that calling sg_init_one with a stack address is a reasonable thing to > do, and it doesn't work with a vmalloced stack. grsecurity works ... O_o ... Why does it not work on a vmalloced stack?? > around this by using a real lowmem higher-order stack, aliasing it > into vmalloc space, and arranging for virt_to_phys to backtrack the > alias, but eww. I think I'd rather find and fix the bugs, assuming > they're straightforward. Yeah. That's ugly. -Kees -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: References: From: Kees Cook Date: Tue, 21 Jun 2016 11:12:31 -0700 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) To: Andy Lutomirski , Herbert Xu Cc: Linus Torvalds , Andy Lutomirski , the arch/x86 maintainers , Linux Kernel Mailing List , "linux-arch@vger.kernel.org" , Borislav Petkov , Nadav Amit , Brian Gerst , "kernel-hardening@lists.openwall.com" , Josh Poimboeuf , Jann Horn , Heiko Carstens List-ID: On Tue, Jun 21, 2016 at 10:27 AM, Andy Lutomirski wrote: > On Tue, Jun 21, 2016 at 10:16 AM, Linus Torvalds > wrote: >> On Tue, Jun 21, 2016 at 9:45 AM, Andy Lutomirski wrote: >>> >>> So I'm leaning toward fewer cache entries per cpu, maybe just one. >>> I'm all for making it a bit faster, but I think we should weigh that >>> against increasing memory usage too much and thus scaring away the >>> embedded folks. >> >> I don't think the embedded folks will be scared by a per-cpu cache, if >> it's just one or two entries. And I really do think that even just >> one or two entries will indeed catch a lot of the cases. >> >> And yes, fork+execve() is too damn expensive in page table build-up >> and tear-down. I'm not sure why bash doesn't do vfork+exec for when it >> has to wait for the process anyway, but it doesn't seem to do that. >> > > I don't know about bash, but glibc very recently fixed a long-standing > but in posix_spawn and started using clone() in a sensible manner for > this. > > FWIW, it may be a while before this can be enabled in distro kernels. > There are some code paths (*cough* crypto users *cough*) that think > that calling sg_init_one with a stack address is a reasonable thing to > do, and it doesn't work with a vmalloced stack. grsecurity works ... O_o ... Why does it not work on a vmalloced stack?? > around this by using a real lowmem higher-order stack, aliasing it > into vmalloc space, and arranging for virt_to_phys to backtrack the > alias, but eww. I think I'd rather find and fix the bugs, assuming > they're straightforward. Yeah. That's ugly. -Kees -- Kees Cook Chrome OS & Brillo Security