> On 28 Feb 2018, at 21:33, Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote: > > On Wed, Feb 28, 2018 at 08:13:00PM +0300, Ilya Smith wrote: >>> It would be worth spelling out the "not recommended" bit some more >>> too: this fragments the mmap space, which has some serious issues on >>> smaller address spaces if you get into a situation where you cannot >>> allocate a hole large enough between the other allocations. >>> >> >> I’m agree, that's the point. > > Would it be worth randomising the address returned just ever so slightly? > ie instead of allocating exactly the next address, put in a guard hole > of (configurable, by default maybe) 1-15 pages? Is that enough extra > entropy to foil an interesting number of attacks, or do we need the full > randomise-the-address-space approach in order to be useful? > This is a really good question. Lets think we choose address with random-length guard hole. This length is limited by some configuration as you described. For instance let it be 1MB. Now according to current implementation, we still may fill this gap with small allocations with size less than 1MB. Attacker will going to build attack base on this predictable behaviour - he jus need to spray with 1 MB chunks (or less, with some expectation). This attack harder but not impossible. Now lets say we will increase this 1MB to 128MB. Attack is the same, successful rate less and more regions needed. Now we increase this value to 48 bit entropy and will get my patch (in some form ;)) I hope full randomise-the-address-space approach will work for a long time. Thanks, Ilya -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href
