Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752477AbeADSmZ (ORCPT + 1 other); Thu, 4 Jan 2018 13:42:25 -0500 Received: from mail-vk0-f68.google.com ([209.85.213.68]:36298 "EHLO mail-vk0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751471AbeADSmW (ORCPT ); Thu, 4 Jan 2018 13:42:22 -0500 X-Google-Smtp-Source: ACJfBosl2y0kcP1b6NiyR5cDM0ytW3Cq6nCHzxbcCHW9InhnUzbJtcgIaVep0897NMjYQxT0DHmAKBMHxWud33z8kNE= MIME-Version: 1.0 In-Reply-To: <20180104183504.GQ28752@n2100.armlinux.org.uk> References: <20180104122801.GA3038@pjb1027-Latitude-E5410> <20180104183504.GQ28752@n2100.armlinux.org.uk> From: Kees Cook Date: Thu, 4 Jan 2018 10:42:21 -0800 X-Google-Sender-Auth: 2YRn9tzq3rmFT6mfm3lMHh8KU_I Message-ID: Subject: Re: [kernel-hardening] [PATCH] arm: Always use REFCOUNT_FULL To: Russell King - ARM Linux Cc: Jinbum Park , Will Deacon , Ard Biesheuvel , kernel-hardening@lists.openwall.com, LKML , Dave Martin , linux-arm-kernel@lists.infradead.org Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Thu, Jan 4, 2018 at 10:35 AM, Russell King - ARM Linux wrote: > On Thu, Jan 04, 2018 at 10:32:46AM -0800, Kees Cook wrote: >> On Thu, Jan 4, 2018 at 4:28 AM, Jinbum Park wrote: >> > arm prefers to use REFCOUNT_FULL by default. >> > This enables it for arm. >> > >> > Signed-off-by: Jinbum Park >> >> Acked-by: Kees Cook > > I'd help if there was some kind of explanation about this. Not > everyone knows what REFCOUNT_FULL is. > > Also, why does "arm" "prefer" to use this? Where does the preference > come from - and why is it a preference but being enforced by the > Kconfig ? This came from discussions with Will Deacon (and others) during the Linux Security Summit. The arm64 side of this is in commit 4adcec1164de ("arm64: Always use REFCOUNT_FULL"). AIUI, Will said he didn't want the specialized "fast but technically incomplete" refcounting as seen with x86's fast refcount infrastructure, but rather to keep refcounts always fully protected by default because no one could point to real-world performance impacts with REFCOUNT_FULL vs unprotected atomic_t infrastructure. I'm fine leaving this choice up to the end user, but I think it makes sense to be always-on. If that's no okay, maybe make it default-y for arm32, and still let people turn it off if they want? -Kees -- Kees Cook Pixel Security