From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5EAEC4363A for ; Tue, 6 Oct 2020 02:19:50 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4E9C220874 for ; Tue, 6 Oct 2020 02:19:50 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XhNVw1+T" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4E9C220874 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 969766B005D; Mon, 5 Oct 2020 22:19:49 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 91B096B0062; Mon, 5 Oct 2020 22:19:49 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 857376B006C; Mon, 5 Oct 2020 22:19:49 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0024.hostedemail.com [216.40.44.24]) by kanga.kvack.org (Postfix) with ESMTP id 5C1DC6B005D for ; Mon, 5 Oct 2020 22:19:49 -0400 (EDT) Received: from smtpin30.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id EB8083632 for ; Tue, 6 Oct 2020 02:19:48 +0000 (UTC) X-FDA: 77339894856.30.grade34_3f15868271c3 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin30.hostedemail.com (Postfix) with ESMTP id CA4AC180B3C85 for ; Tue, 6 Oct 2020 02:19:48 +0000 (UTC) X-HE-Tag: grade34_3f15868271c3 X-Filterd-Recvd-Size: 4559 Received: from mail-ej1-f67.google.com (mail-ej1-f67.google.com [209.85.218.67]) by imf43.hostedemail.com (Postfix) with ESMTP for ; Tue, 6 Oct 2020 02:19:48 +0000 (UTC) Received: by mail-ej1-f67.google.com with SMTP id ly6so13933033ejb.8 for ; Mon, 05 Oct 2020 19:19:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5RQGQQnzUDnv0mOraeBJTeR9VvHirvaV4JaPm4c+FnM=; b=XhNVw1+TBfKHXDS9ILNRhsKTwQkADm6bKZt0zmGoCf9RgtxlAMSHmVejVLnM+hlQ92 9h1bZRhd7XNx+Pyw4umW8tO3rsbDSYAT7TFN/BzcPFURPd/PbJaqRc0mm9uvXokDH8UD twLL6dA+UDImJ+xLxiFncIkwWOcVKLiIe+8/9fcDubmIl8YA6uqSmPA/Wop8j+DGiOzn fGXMDXhS5LJFaU/q4N03ythlCP8rgQPXyZn2wsuvvHKD6yWdvHdfCyoIUA5mgHl+16us 9bIcRZ+VPstpHqmqgrQIz0bq7JqtPJa7d80mrw+1cbzqCm/yjj5Nqh6LXLQdB0eZfSqU kSxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5RQGQQnzUDnv0mOraeBJTeR9VvHirvaV4JaPm4c+FnM=; b=i7iFE6GEmV/7RT7fiQLICSexwiYmok6TPsgUOaepKp8H83NWke1qGTFeErLTijtEUi qPJSjhgx+2TIuLyK4+XXB86eZUcneOkRAjIMlTljherDpP0rzhRIO+Sc405OeJlf8y8s gSjewp9Hx8pzF7PRl36GlsUX12Bj0KvqGTFa4hExNrilw5H03KT1IXpBnTPS53oEDX45 /n7JTIKk1l4RALSo1C2NzdeJKayUSoFYk7kjatUp5m4+loatDqQKjYWwDYg1qBlnPeQw OpmJyW3IoXoWlCQqC1ftw9nc410ARK8AxkGivWCSiBFo0mb7RwCNZ88Ap9t+bskRaZbj ILrw== X-Gm-Message-State: AOAM533rfNDakA/A6jFO6lnZviDnMevDPWqwKKGytV3NilsmLQMjFGPU l4k9SwY+f245vGUkUBnWAuoFBP+b2nWLkIpgWdg= X-Google-Smtp-Source: ABdhPJxdtW1KHo9nm8XsftaIlbJ6Jt+UypzA4SMemizIx7+yhJ4RSe/qGU0OzOwdpL5vrNU/i9b2ut1DDWsxfYGMJEE= X-Received: by 2002:a17:906:7d52:: with SMTP id l18mr2771101ejp.220.1601950787443; Mon, 05 Oct 2020 19:19:47 -0700 (PDT) MIME-Version: 1.0 References: <20200929183513.380760-1-alex.popov@linux.com> <91d564a6-9000-b4c5-15fd-8774b06f5ab0@linux.com> <20201006004414.GP20115@casper.infradead.org> <202010051905.62D79560@keescook> In-Reply-To: <202010051905.62D79560@keescook> From: Daniel Micay Date: Mon, 5 Oct 2020 22:19:10 -0400 Message-ID: Subject: Re: [PATCH RFC v2 0/6] Break heap spraying needed for exploiting use-after-free To: Kees Cook Cc: Matthew Wilcox , Jann Horn , Alexander Popov , Will Deacon , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Masahiro Yamada , Masami Hiramatsu , Steven Rostedt , Peter Zijlstra , Krzysztof Kozlowski , Patrick Bellasi , David Howells , Eric Biederman , Johannes Weiner , Laura Abbott , Arnd Bergmann , Greg Kroah-Hartman , Andrey Konovalov , Pavel Machek , Valentin Schneider , kasan-dev , Linux-MM , Kernel Hardening , kernel list , notify@kernel.org Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: It will reuse the memory for other things when the whole slab is freed though. Not really realistic to change that without it being backed by virtual memory along with higher-level management of regions to avoid intense fragmentation and metadata waste. It would depend a lot on having much finer-grained slab caches, otherwise it's not going to be much of an alternative to a quarantine feature. Even then, a quarantine feature is still useful, but is less suitable for a mainstream feature due to performance cost. Even a small quarantine has a fairly high performance cost.