linux-kernel - Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180323192952.GB23763@bombadil.infradead.org>
Date:   Fri, 23 Mar 2018 12:29:52 -0700
From:   Matthew Wilcox <willy@...radead.org>
To:     Rich Felker <dalias@...c.org>
Cc:     Ilya Smith <blackzert@...il.com>, rth@...ddle.net,
        ink@...assic.park.msu.ru, mattst88@...il.com, vgupta@...opsys.com,
        linux@...linux.org.uk, tony.luck@...el.com, fenghua.yu@...el.com,
        jhogan@...nel.org, ralf@...ux-mips.org, jejb@...isc-linux.org,
        deller@....de, benh@...nel.crashing.org, paulus@...ba.org,
        mpe@...erman.id.au, schwidefsky@...ibm.com,
        heiko.carstens@...ibm.com, ysato@...rs.sourceforge.jp,
        davem@...emloft.net, tglx@...utronix.de, mingo@...hat.com,
        hpa@...or.com, x86@...nel.org, nyc@...omorphy.com,
        viro@...iv.linux.org.uk, arnd@...db.de, gregkh@...uxfoundation.org,
        deepa.kernel@...il.com, mhocko@...e.com, hughd@...gle.com,
        kstewart@...uxfoundation.org, pombredanne@...b.com,
        akpm@...ux-foundation.org, steve.capper@....com,
        punit.agrawal@....com, paul.burton@...s.com,
        aneesh.kumar@...ux.vnet.ibm.com, npiggin@...il.com,
        keescook@...omium.org, bhsharma@...hat.com, riel@...hat.com,
        nitin.m.gupta@...cle.com, kirill.shutemov@...ux.intel.com,
        dan.j.williams@...el.com, jack@...e.cz,
        ross.zwisler@...ux.intel.com, jglisse@...hat.com,
        aarcange@...hat.com, oleg@...hat.com, linux-alpha@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-snps-arc@...ts.infradead.org,
        linux-arm-kernel@...ts.infradead.org, linux-ia64@...r.kernel.org,
        linux-metag@...r.kernel.org, linux-mips@...ux-mips.org,
        linux-parisc@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
        linux-s390@...r.kernel.org, linux-sh@...r.kernel.org,
        sparclinux@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap.

On Fri, Mar 23, 2018 at 03:16:21PM -0400, Rich Felker wrote:
> > Huh, I thought libc was aware of this.  Also, I'd expect a libc-based
> > implementation to restrict itself to, eg, only loading libraries in
> > the bottom 1GB to avoid applications who want to map huge things from
> > running out of unfragmented address space.
> 
> That seems like a rather arbitrary expectation and I'm not sure why
> you'd expect it to result in less fragmentation rather than more. For
> example if it started from 1GB and worked down, you'd immediately
> reduce the contiguous free space from ~3GB to ~2GB, and if it started
> from the bottom and worked up, brk would immediately become
> unavailable, increasing mmap pressure elsewhere.

By *not* limiting yourself to the bottom 1GB, you'll almost immediately
fragment the address space even worse.  Just looking at 'ls' as a
hopefully-good example of a typical app, it maps:

	linux-vdso.so.1 (0x00007ffef5eef000)
	libselinux.so.1 => /lib/x86_64-linux-gnu/libselinux.so.1 (0x00007fb3657f5000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fb36543b000)
	libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fb3651c9000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fb364fc5000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fb365c3f000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fb364da7000)

The VDSO wouldn't move, but look at the distribution of mapping 6 things
into a 3GB address space in random locations.  What are the odds you have
a contiguous 1GB chunk of address space?  If you restrict yourself to the
bottom 1GB before running out of room and falling back to a sequential
allocation, you'll prevent a lot of fragmentation.