[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20230811153357.3cdfdbeb@gandalf.local.home>
Date: Fri, 11 Aug 2023 15:33:57 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Kees Cook <keescook@...omium.org>
Cc: Marco Elver <elver@...gle.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Guenter Roeck <linux@...ck-us.net>,
Peter Zijlstra <peterz@...radead.org>,
Mark Rutland <mark.rutland@....com>,
Marc Zyngier <maz@...nel.org>,
Oliver Upton <oliver.upton@...ux.dev>,
James Morse <james.morse@....com>,
Suzuki K Poulose <suzuki.poulose@....com>,
Zenghui Yu <yuzenghui@...wei.com>,
Catalin Marinas <catalin.marinas@....com>,
Will Deacon <will@...nel.org>,
Nathan Chancellor <nathan@...nel.org>,
Nick Desaulniers <ndesaulniers@...gle.com>,
Tom Rix <trix@...hat.com>, Miguel Ojeda <ojeda@...nel.org>,
Sami Tolvanen <samitolvanen@...gle.com>,
linux-arm-kernel@...ts.infradead.org, kvmarm@...ts.linux.dev,
linux-kernel@...r.kernel.org, llvm@...ts.linux.dev,
Dmitry Vyukov <dvyukov@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
kasan-dev@...glegroups.com, linux-toolchains@...r.kernel.org
Subject: Re: [PATCH v3 3/3] list_debug: Introduce CONFIG_DEBUG_LIST_MINIMAL
On Thu, 10 Aug 2023 13:11:58 -0700
Kees Cook <keescook@...omium.org> wrote:
> > [...]
> > + /*
> > + * With the hardening version, elide checking if next and prev
> > + * are NULL, LIST_POISON1 or LIST_POISON2, since the immediate
> > + * dereference of them below would result in a fault.
> > + */
> > + if (likely(prev->next == entry && next->prev == entry))
> > + return true;
>
> I'm not super excited about skipping those checks, since they are
> values that can be reached through kernel list management confusion. If
> an attacker is using a system where the zero-page has been mapped
> and is accessible (i.e. lacking SMAP etc), then attacks could still
> be constructed. However, I do recognize this chain of exploitation
> prerequisites is getting rather long, so probably this is a reasonable
> trade off on modern systems.
A totally hardened machine is one that doesn't run ;-)
Yes, hopefully that when the kernel is configured with HARDENED it will
eliminate steps to a prerequisite attack. I'm sure enabling lockdep would
also help harden the system too. But there is a balance between security
and performance. The more that adding security harms performance, the less
people will use that security.
-- Steve
Powered by blists - more mailing lists