Message-ID: <CAG_fn=XnynfbY5pYQqJz7XAwz_fHJXmF5jNmVCrTAtgKBf1LzQ@mail.gmail.com>
Date:   Wed, 6 Sep 2023 16:17:07 +0200
From:   Alexander Potapenko <glider@...gle.com>
To:     Eric Biggers <ebiggers@...nel.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Michal Hocko <mhocko@...e.com>,
        Zhaoyang Huang <huangzhaoyang@...il.com>,
        Matthew Wilcox <willy@...radead.org>,
        "zhaoyang.huang" <zhaoyang.huang@...soc.com>,
        Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, ke.wang@...soc.com,
        Marco Elver <elver@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Kees Cook <keescook@...omium.org>,
        Mateusz Guzik <mjguzik@...il.com>,
        Al Viro <viro@...iv.linux.org.uk>
Subject: Re: [PATCH] mm: make __GFP_SKIP_ZERO visible to skip zero operation

On Mon, Sep 4, 2023 at 8:22 PM Eric Biggers <ebiggers@...nel.org> wrote:
>
> On Mon, Sep 04, 2023 at 10:34:25AM -0700, Linus Torvalds wrote:
> > On Mon, 4 Sept 2023 at 00:55, Michal Hocko <mhocko@...e.com> wrote:
> > >
> > >       Sooner or later this will become an
> > > unreviewable mess so the value of init_on_alloc will become very
> > > dubious.
> >
> > The value of init_on_alloc is *already* very dubious.
> >
> > Exactly because people will turn it off, because it hurts performance
> > so much - and in pointless ways.
> >
> > You do realize that distributions - well, at least Fedora - simply
> > don't turn INIT_ON_ALLOC_DEFAULT_ON on at all?
> >
> > So the current state of init_on_alloc is that nobody sane uses it. You
> > have to think you're special to enable it, because it is *so* bad.
> >
> > Security people need to realize that the primary point of computing is
> > NEVER EVER security. Security is entirely pointless without a usable
> > system.
> >
> > Unless security people realize that they are always secondary, they
> > aren't security people, they are just random wankers.
> >
> > And people who state this truism had better not get shamed for
> > standing up to stupidity.
> >
>
> Android and Ubuntu both set CONFIG_INIT_ON_ALLOC_DEFAULT_ON.  I think this makes
> it clear that the init-on-alloc feature is useful for a substantial amount of
> users even in its current form.
>
> I would caution against checking the kernel config for the distro you happen to
> be using and extrapolating that to all Linux systems.
>
> Regardless, I'm in favor of a per allocation opt-out flag like GFP_SKIP_ZERO.
> There are clear cases where it makes sense, for example some places in the VFS
> where the performance impact is large and the code has been carefully reviewed.

What are our options to prevent this flag from spreading uncontrollably?
Would it make sense to still provide a separate API for such
allocations, so that the flag doesn't get added into some module-level
`gfp` variable?

>
> I don't really like the idea
> (https://lore.kernel.org/lkml/CAG_fn=UQEuvJ9WXou_sW3moHcVQZJ9NvJ5McNcsYE8xw_WEYGw@mail.gmail.com/)
> of making the system administrator have to opt out allocation sites individually
> via a kernel command-line parameter.  Yes, it makes the opt out less likely to
> be abused as two parties (developer and system administrator) have to consent to
> each individual opt out.  So it theory it sounds good.  But I feel that doesn't
> outweigh the fact that it would be complicated and hard to use.  How about just
> having two options: one to always honor GFP_SKIP_ZERO in the code and one to
> always ignore it.

I am afraid we still need some level of granularity here.
E.g. we definitely want to skip initialization for kstrdup(),
kmemdup() and friends, some would say even on the systems running with
init_on_alloc=1.
For e.g. 3rd party driver allocations we also need an opt-out flag,
but the need for a kill switch to disable that flag is higher. On the
other hand, that kill switch does not have to disable the carefully
reviewed opt-outs in the upstream code.

Assuming that OS vendors usually control their kernel source, we can
probably distinguish between opting out the allocations done within
statically linked code and the modules, introducing the following
levels of initialization that could be controlled by init_on_alloc:
 - init_on_alloc=1 - initialize all allocations, like it's done currently
 - init_on_alloc=except_static_optouts - initialize all allocations,
allow GFP_SKIP_ZERO in the statically linked code
 - init_on_alloc=except_optouts - initialize all allocations, allow
GFP_SKIP_ZERO in the kernel and the modules
 - init_on_alloc=0 - do not initialize allocations by default

In this scheme, the system administrator may choose to either be
paranoid, or choose to trust just their OS vendor, or trust the driver
vendors as well.
In any case, it will be possible to dynamically pull the plug on the opt-outs.

>
> - Eric




--
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Liana Sebastian
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg

Powered by blists - more mailing lists