Surge 2015 - Lightning Talks
Why Hacker News recommends it
Cited as a classic Cantrill talk when threads discuss madvise, malloc and Dirty COW behavior.
What it is
A collection of lightning talks from the Surge 2015 conference on scalable systems, hosted by Geir Magnusson. HN mostly points to one segment, a Bryan Cantrill talk touching on madvise semantics.
Recommended by 0 HN commenters across 0 different months, 2017 to 2020.
What Hacker News said
Cites mannykannot · 2017-05 · on “How Dirty COW works from the Linux kernel’s perspective”
Perhaps the talk[1] given by Bryan Cantrill in 2015, and mentioned in footnote 1 of the article, may have alerted someone to the possibility that there might be something exploitable here? In addition, any of the other online discussions of madvise(,,MADV_DONTNEED), mentioned in that talk, may have attracted someone's interest. This exploit seems to lie at the intersection of several things that I guess might indicate a higher-than-average risk of exploitability: shared memory, special provisions for debugging access to running processes, complicated and unintuitive (if not broken) semantics, and concurrency. [1] [this video]
Cites gbrown_ · 2020-01 · on “Umbra: an ACID-compliant database built for in-memory analytics speed”
From the paper. > and subsequently allow the kernel to immediately reuse the associated physical memory. On Linux, this can be achieved by passing the MADV_DONTNEED flag to the the madvise system call. Shouldn't this be MADV_FREE? This instantly reminded me of this classic Bryan Cantrill talk [this video] Edit: It seems that the Linux behavior is relied upon? From later in the paper. > Note that it is even legal for a page to be unloaded while the page con-tent is being read optimistically. This is possible since the virtual memory region reserved for a buffer frame always remains valid (see above), and read accesses to a memory region that was marked with the MADV_DONTNEED flag simply result in
Cites kevinoid · 2020-03 · on “Glibc malloc inefficiency (2016)”
Although this is true on Linux, it's worth noting that this behavior doesn't match the specified behavior of posix_madvise.[1] It was also a subject of Bryan Cantril's hilarious "A crime against common sense" Surge 2015 talk (at ~1:06:50).[2] [1]: [LINK] [2]: [this video]