From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lf0-f71.google.com (mail-lf0-f71.google.com [209.85.215.71]) by kanga.kvack.org (Postfix) with ESMTP id 8241C6B0024 for ; Wed, 28 Mar 2018 17:07:39 -0400 (EDT) Received: by mail-lf0-f71.google.com with SMTP id u129-v6so1131368lff.9 for ; Wed, 28 Mar 2018 14:07:39 -0700 (PDT) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id r8sor1194879ljj.20.2018.03.28.14.07.38 for (Google Transport Security); Wed, 28 Mar 2018 14:07:38 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) Subject: Re: [RFC PATCH v2 0/2] Randomization of address chosen by mmap. From: Ilya Smith In-Reply-To: <20180327234904.GA27734@bombadil.infradead.org> Date: Thu, 29 Mar 2018 00:07:35 +0300 Content-Transfer-Encoding: quoted-printable Message-Id: References: <1521736598-12812-1-git-send-email-blackzert@gmail.com> <20180323124806.GA5624@bombadil.infradead.org> <651E0DB6-4507-4DA1-AD46-9C26ED9792A8@gmail.com> <20180326084650.GC5652@dhcp22.suse.cz> <01A133F4-27DF-4AE2-80D6-B0368BF758CD@gmail.com> <20180327072432.GY5652@dhcp22.suse.cz> <0549F29C-12FC-4401-9E85-A430BC11DA78@gmail.com> <20180327234904.GA27734@bombadil.infradead.org> Sender: owner-linux-mm@kvack.org List-ID: To: Matthew Wilcox Cc: Kees Cook , Michal Hocko , Richard Henderson , ink@jurassic.park.msu.ru, mattst88@gmail.com, Vineet Gupta , Russell King , Tony Luck , Fenghua Yu , Ralf Baechle , "James E.J. Bottomley" , Helge Deller , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Martin Schwidefsky , Heiko Carstens , Yoshinori Sato , Rich Felker , "David S. Miller" , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , X86 ML , nyc@holomorphy.com, Al Viro , Arnd Bergmann , Greg KH , Deepa Dinamani , Hugh Dickins , Kate Stewart , Philippe Ombredanne , Andrew Morton , Steve Capper , Punit Agrawal , "Aneesh Kumar K.V" , Nick Piggin , Bhupesh Sharma , Rik van Riel , nitin.m.gupta@oracle.com, "Kirill A. Shutemov" , Dan Williams , Jan Kara , Ross Zwisler , Jerome Glisse , Andrea Arcangeli , Oleg Nesterov , linux-alpha@vger.kernel.org, LKML , linux-snps-arc@lists.infradead.org, linux-ia64@vger.kernel.org, linux-metag@vger.kernel.org, Linux MIPS Mailing List , linux-parisc , PowerPC , linux-s390 , linux-sh , sparclinux , Linux-MM > On 28 Mar 2018, at 02:49, Matthew Wilcox wrote: >=20 > On Tue, Mar 27, 2018 at 03:53:53PM -0700, Kees Cook wrote: >> I agree: pushing this off to libc leaves a lot of things unprotected. >> I think this should live in the kernel. The question I have is about >> making it maintainable/readable/etc. >>=20 >> The state-of-the-art for ASLR is moving to finer granularity (over >> just base-address offset), so I'd really like to see this supported = in >> the kernel. We'll be getting there for other things in the future, = and >> I'd like to have a working production example for researchers to >> study, etc. >=20 > One thing we need is to limit the fragmentation of this approach. > Even on 64-bit systems, we can easily get into a situation where there = isn't > space to map a contiguous terabyte. As I wrote before, shift_random is introduced to be fragmentation limit. = Even=20 without it, the main question here is =E2=80=98if we can=E2=80=99t = allocate memory with N size=20 bytes, how many bytes we already allocated?=E2=80=99. =46rom these point = of view I=20 already showed in previous version of patch that if application uses not = so big=20 memory allocations, it will have enough memory to use. If it uses XX = Gigabytes=20 or Terabytes memory, this application has all chances to be exploited = with=20 fully randomization or without. Since it is much easier to find(or = guess) any=20 usable pointer, etc. For the instance you have only 128 terabytes of = memory for=20 user space, so probability to exploit this application is 1/128 what is = not=20 secure at all. This is very rough estimate but I try to make things = easier to=20 understand. Best regards, Ilya