linux-kernel - Re: [kernel-hardening] [PATCH] arm: Always use REFCOUNT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 Jan 2018 10:42:21 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Russell King - ARM Linux <linux@...linux.org.uk>
Cc:     Jinbum Park <jinb.park7@...il.com>,
        Will Deacon <will.deacon@....com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        kernel-hardening@...ts.openwall.com,
        LKML <linux-kernel@...r.kernel.org>,
        Dave Martin <Dave.Martin@....com>,
        linux-arm-kernel@...ts.infradead.org
Subject: Re: [kernel-hardening] [PATCH] arm: Always use REFCOUNT_FULL

On Thu, Jan 4, 2018 at 10:35 AM, Russell King - ARM Linux
<linux@...linux.org.uk> wrote:
> On Thu, Jan 04, 2018 at 10:32:46AM -0800, Kees Cook wrote:
>> On Thu, Jan 4, 2018 at 4:28 AM, Jinbum Park <jinb.park7@...il.com> wrote:
>> > arm prefers to use REFCOUNT_FULL by default.
>> > This enables it for arm.
>> >
>> > Signed-off-by: Jinbum Park <jinb.park7@...il.com>
>>
>> Acked-by: Kees Cook <keescook@...omium.org>
>
> I'd help if there was some kind of explanation about this.  Not
> everyone knows what REFCOUNT_FULL is.
>
> Also, why does "arm" "prefer" to use this?  Where does the preference
> come from - and why is it a preference but being enforced by the
> Kconfig ?

This came from discussions with Will Deacon (and others) during the
Linux Security Summit. The arm64 side of this is in commit
4adcec1164de ("arm64: Always use REFCOUNT_FULL"). AIUI, Will said he
didn't want the specialized "fast but technically incomplete"
refcounting as seen with x86's fast refcount infrastructure, but
rather to keep refcounts always fully protected by default because no
one could point to real-world performance impacts with REFCOUNT_FULL
vs unprotected atomic_t infrastructure.

I'm fine leaving this choice up to the end user, but I think it makes
sense to be always-on. If that's no okay, maybe make it default-y for
arm32, and still let people turn it off if they want?

-Kees

-- 
Kees Cook
Pixel Security