On Fri, Mar 3, 2017 at 4:23 PM, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: > On Mon, 20 Feb 2017 13:29:46 +0200 Elena Reshetova <elena.reshetova@xxxxxxxxx> wrote: > >> Now when new refcount_t type and API are finally merged >> (see include/linux/refcount.h), the following >> patches convert various refcounters in the ipc susystem from atomic_t >> to refcount_t. By doing this we prevent intentional or accidental >> underflows or overflows that can led to use-after-free vulnerabilities. >> >> The below patches are fully independent and can be cherry-picked separately. >> Since we convert all kernel subsystems in the same fashion, resulting >> in about 300 patches, we have to group them for sending at least in some >> fashion to be manageable. Please excuse the long cc list. > > Again, the refcount_t operations are much more expensive than the bare > atomic_t operations. I'm reluctant to merge any of these conversions Since Manfred did a recent refactor of IPC RCU, and the refcount usage is minimal, it seemed a good time to ask after these patches again. (And send an updated one for the refactor.) > without either > > a) a convincing demonstration that the performance impact is > sufficiently small (ie: unmeasurable) or I've sent a few versions of a much faster refcount implementation which has no measurable difference to atomic_t operations (based on the PaX implementation). Getting more eyes on that would be nice; I'll include you on CC when I send the next version. > b) a compile-time option to disable the refcount_t operations (make > them generate the same code as the bare atomic_t ops). Along with > some suitably reliable means of preventing people from accidentally > enabling the debug code in production builds. Since the speed-ups will likely be arch-specific, should my proposed CONFIG_FAST_REFCOUNT be made arch-indep when no arch-specific implementation available (via totally unchecked atomic_t ops)? i.e.: FAST_REFCOUNT=n: use function-based refcount_t with cmpxvhg and full-verification FAST_REFCOUNT=y without arch-specific implementation: use atomic_t with no verification (i.e. no functional change from now) FAST_REFCOUNT=y with arch-specific implementation: use atomic_t with overflow protection which means FAST_REFCOUNT would need to be default-on so that mm, block, net users will remain happy. Does that sound reasonable? -Kees -- Kees Cook Pixel Security
