From: Noah Misch <noah@leadboat.com>
To: Andres Freund <andres@anarazel.de>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-hackers@postgresql.org
Subject: Re: OK, so culicidae is *still* broken
Date: Sat, 20 May 2017 12:26:33 +0000
Message-ID: <20170520122633.GB828137@rfd.leadboat.com> (raw)
In-Reply-To: <20170415213017.co7gkjlbcy44zlmw@alap3.anarazel.de>
References: <7036.1492231361@sss.pgh.pa.us>
<18D5D7AF-C587-4B63-B2CF-13590849A624@anarazel.de>
<32559.1492278226@sss.pgh.pa.us>
<1842.1492289285@sss.pgh.pa.us>
<20170415210643.cdapwhwmbiwaqd6e@alap3.anarazel.de>
<2829.1492290578@sss.pgh.pa.us>
<20170415211810.vsing3muvqfcswqx@alap3.anarazel.de>
<3667.1492291494@sss.pgh.pa.us>
<20170415213017.co7gkjlbcy44zlmw@alap3.anarazel.de>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On Sat, Apr 15, 2017 at 02:30:18PM -0700, Andres Freund wrote:
> On 2017-04-15 17:24:54 -0400, Tom Lane wrote:
> > Andres Freund <andres@anarazel.de> writes:
> > > On 2017-04-15 17:09:38 -0400, Tom Lane wrote:
> > >> Why doesn't Windows' ability to map the segment into the new process
> > >> before it executes take care of that?
> >
> > > Because of ASLR of the main executable (i.e. something like PIE).
> >
> > Not following. Are you saying that the main executable gets mapped into
> > the process address space immediately, but shared libraries are not?
At the time of the pgwin32_ReserveSharedMemoryRegion() call, the child process
contains only ntdll.dll and the executable.
> Without PIE/ASLR we can somewhat rely on pgwin32_ReserveSharedMemoryRegion
> to find the space that PGSharedMemoryCreate allocated still unoccupied.
I've never had access to a Windows system that can reproduce the fork
failures. My best theory is that antivirus or similar software injects an
additional DLL at that early stage.
> > I wonder whether we could work around that by just destroying the created
> > process and trying again if we get a collision. It'd be a tad
> > inefficient, but hopefully collisions wouldn't happen often enough to be a
> > big problem.
>
> That might work, although it's obviously not pretty.
I didn't like that idea when Michael proposed it in 2015. Since disabling
ASLR on the exe proved insufficient, I do like it now. It degrades nicely; if
something raises the collision rate from 1% to 10%, that just looks like fork
latency degrading.
> We could also just
> default to some out-of-the-way address for MapViewOfFileEx, that might
> also work.
Dave Vitek proposed that:
https://www.postgresql.org/message-id/flat/5046CAEB.4010600%40grammatech.com
I estimate more risk than retrying forks. There's no guarantee that a fixed
address helpful today won't make the collisions worse after the next Windows
security patch.
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: noah@leadboat.com, andres@anarazel.de, tgl@sss.pgh.pa.us
Subject: Re: OK, so culicidae is *still* broken
In-Reply-To: <20170520122633.GB828137@rfd.leadboat.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox