[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <202008191626.1420C63231@keescook>
Date: Wed, 19 Aug 2020 16:36:10 -0700
From: Kees Cook <keescook@...omium.org>
To: Jirka Hladky <jhladky@...hat.com>
Cc: Alexander Potapenko <glider@...gle.com>,
kernel-hardening@...ts.openwall.com, linux-mm@...ck.org,
linux-security-module@...r.kernel.org
Subject: Re: init_on_alloc/init_on_free boot options
On Thu, Aug 20, 2020 at 12:18:33AM +0200, Jirka Hladky wrote:
> Could you please help me to clarify the purpose of init_on_alloc=1
> when init_on_free is enabled?
It's to zero memory at allocation time. :) (They are independent
options.)
> If I get it right, init_on_free=1 alone guarantees that the memory
> returned by the page allocator and SL[AU]B is initialized with zeroes.
No, it's guarantees memory freed by the page/slab allocators are zeroed.
> What is the purpose of init_on_alloc=1 in that case? We are zeroing
> memory twice, or am I missing something?
If you have both enabled, yes, you will zero twice. (In theory, if you
have any kind of Use-After-Free/dangling pointers that get written
through after free and before alloc, those contents wouldn't strictly be
zero at alloc time without init_on_alloc. But that's pretty rare.
I wouldn't expect many people to run with both options enabled;
init_on_alloc is more performance-friendly (i.e. cache-friendly), and
init_on_free minimizes the lifetime of stale data in memory.
It appears that the shipping kernel defaults for several distros (Ubuntu,
Arch, Debian, others?) and devices (Android, Chrome OS, others?) are using
init_on_alloc=1. Will Fedora and/or RedHat be joining this trend? :)
--
Kees Cook
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
