On Thu, May 14, 2015 at 04:19:45PM +0200, Anisse Astier wrote: > Hi, > > I'm trying revive an old debate here[1], though with a simpler approach than > was previously tried. This patch series implements a new option to sanitize > freed pages, a (very) small subset of what is done in PaX/grsecurity[3], > inspired by a previous submission [4]. > > There are a few different uses that this can cover: > - some cases of use-after-free could be detected (crashes), although this not > as efficient as KAsan/kmemcheck They're not detected, they're hidden. I'm currently seeing problems with a glibc update in userspace where applications are crashing because glibc returns buffers with uninitialised data that would previously have been zero. In every case so far, they were application bugs that need fixing. Having the kernel crash due to uninitialised memory use is bad but hiding it is not better. > - it can help with long-term memory consumption in an environment with > multiple VMs and Kernel Same-page Merging on the host. [2] This is not quantified but a better way of dealing with that problem would be for a guest to signal to the host when a page is really free. I vaguely recall that s390 has some hinting of this nature. While I accept there may be some benefits in some cases, I think it's a weak justification for always zeroing pages on free. > - finally, it can reduce infoleaks, although this is hard to measure. > It obscures them. That is leaving aside the fact that this has to be enabled at kconfig time which is unlikely to happen on a distribution config. Not many workloads depend on the freed path as such but streaming readers are one once the files are larger than memory. > The approach is voluntarily kept as simple as possible. A single configuration > option, no command line option, no sysctl nob. It can of course be changed, > although I'd be wary of runtime-configuration options that could be used for > races. > > I haven't been able to measure a meaningful performance difference when > compiling a (in-cache) kernel; I'd be interested to see what difference it > makes with your particular workload/hardware (I suspect mine is CPU-bound on > this small laptop). > What did you use to determine this and did you check if it was hitting the free paths heavily while it's running? It can be very easy to hide the cost of something like this if all the frees happen at exit. Overall, I'm not a big fan of this series. I think it would have made more sense to use non-temporal cleaning on pages if they are freed by kswapd or on a non-critical path like exit and then track if the page was already freed during allocation. Then add a runtime sysctl to make that strict and force all zeroing on all frees. As it is, I think it'll have very few users because of the need to enable it at kernel build time and then incur an unavoidable penalty. -- Mel Gorman SUSE Labs -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>