init_on_alloc/init_on_free boot options

init_on_alloc/init_on_free boot options

[Jirka Hladky]

Hi Alex,

Could you please help me to clarify the purpose of init_on_alloc=1
when init_on_free is enabled?

If I get it right, init_on_free=1 alone guarantees that the memory
returned by the page allocator and SL[AU]B is initialized with zeroes.
What is the purpose of init_on_alloc=1 in that case? We are zeroing
memory twice, or am I missing something?

Thanks a lot!
Jirka

Re: init_on_alloc/init_on_free boot options

[Kees Cook]

On Thu, Aug 20, 2020 at 12:18:33AM +0200, Jirka Hladky wrote:
> Could you please help me to clarify the purpose of init_on_alloc=1
> when init_on_free is enabled?

It's to zero memory at allocation time. :) (They are independent
options.)

> If I get it right, init_on_free=1 alone guarantees that the memory
> returned by the page allocator and SL[AU]B is initialized with zeroes.

No, it's guarantees memory freed by the page/slab allocators are zeroed.

> What is the purpose of init_on_alloc=1 in that case? We are zeroing
> memory twice, or am I missing something?

If you have both enabled, yes, you will zero twice. (In theory, if you
have any kind of Use-After-Free/dangling pointers that get written
through after free and before alloc, those contents wouldn't strictly be
zero at alloc time without init_on_alloc. But that's pretty rare.

I wouldn't expect many people to run with both options enabled;
init_on_alloc is more performance-friendly (i.e. cache-friendly), and
init_on_free minimizes the lifetime of stale data in memory.

It appears that the shipping kernel defaults for several distros (Ubuntu,
Arch, Debian, others?) and devices (Android, Chrome OS, others?) are using
init_on_alloc=1. Will Fedora and/or RedHat be joining this trend?  :)

-- 
Kees Cook

Re: init_on_alloc/init_on_free boot options

[Jirka Hladky]

Thanks a lot for the clarification! I was scratching my head if it
makes sense to enable both options simultaneously.


On Thu, Aug 20, 2020 at 1:36 AM Kees Cook <keescook@chromium.org> wrote:
>
> On Thu, Aug 20, 2020 at 12:18:33AM +0200, Jirka Hladky wrote:
> > Could you please help me to clarify the purpose of init_on_alloc=1
> > when init_on_free is enabled?
>
> It's to zero memory at allocation time. :) (They are independent
> options.)
>
> > If I get it right, init_on_free=1 alone guarantees that the memory
> > returned by the page allocator and SL[AU]B is initialized with zeroes.
>
> No, it's guarantees memory freed by the page/slab allocators are zeroed.
>
> > What is the purpose of init_on_alloc=1 in that case? We are zeroing
> > memory twice, or am I missing something?
>
> If you have both enabled, yes, you will zero twice. (In theory, if you
> have any kind of Use-After-Free/dangling pointers that get written
> through after free and before alloc, those contents wouldn't strictly be
> zero at alloc time without init_on_alloc. But that's pretty rare.
>
> I wouldn't expect many people to run with both options enabled;
> init_on_alloc is more performance-friendly (i.e. cache-friendly), and
> init_on_free minimizes the lifetime of stale data in memory.
>
> It appears that the shipping kernel defaults for several distros (Ubuntu,
> Arch, Debian, others?) and devices (Android, Chrome OS, others?) are using
> init_on_alloc=1. Will Fedora and/or RedHat be joining this trend?  :)
>
> --
> Kees Cook
>


-- 
-Jirka