linux-kernel - Re: [PATCHv2] lkdtm: Add READ_AFTER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <56D4F242.8070508@redhat.com>
Date:	Mon, 29 Feb 2016 17:37:06 -0800
From:	Laura Abbott <labbott@...hat.com>
To:	Kees Cook <keescook@...omium.org>
Cc:	Laura Abbott <labbott@...oraproject.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Arnd Bergmann <arnd@...db.de>,
	"kernel-hardening@...ts.openwall.com" 
	<kernel-hardening@...ts.openwall.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCHv2] lkdtm: Add READ_AFTER_FREE test

On 02/26/2016 02:33 PM, Kees Cook wrote:
> On Fri, Feb 26, 2016 at 2:19 PM, Laura Abbott <labbott@...hat.com> wrote:
>> I did a quick hack of zero poisoning for the slab allocator and I
>> didn't see any improvement in hackbench performance which is fairly
>> sensitive to slab performance. This doesn't surprise me when I
>> actually think about it.
>>
>> Before I sent out my last set of performance optimizations for
>> SLUB debug path, I did a profile with ftrace to see if there was
>> anything else quick I could do. My profiling showed that the
>> poisoning itself was not where most of the allocation time was
>> spent. 25-50% of the time was being spent in removing the CPU slab.
>> Considering poisoning means that the CPU slab is never really used,
>> this can probably be improved. It's worth noting that the
>> PAX_MEMORY_SANITIZE implementation still uses the fast path so it
>> isn't affected here. (The trade off is a minor penalty on the
>> fast path even when poisoning is disabled which isn't acceptable
>> to the maintainers currently.)
>
> Oh right, all of this is still the slow path...
>
>> Basically, until we've optimized other things I don't think the
>> zero poisoning will have a significant effect on performance.
>> The next set of optimizations will involve changing some of the
>> guts of the SLUB allocator. I have some ideas how to approach this
>> but we'll see if they pan out.
>
> And we can't just have a CONFIG for the fast-path sanitization? Then
> it's not in anyone's way, etc?
>

I proposed that but it was shot down :(

The request was to try and make the slow path work so I'm going to
do my due diligence there. If it turns out that it still isn't fast
enough I'll bring it up again but unless we can say that slow path
is still x% slower even after optimization I don't think it will fly.

> -Kees
>

Thanks,
Laura