anon (anon.delete@this.gmail.com) on March 3, 2021 11:54 am wrote:
> Generate checksum on write & verify before copying to user space buffer on every read?

That's not doable anyway, since shared mappings are a thing. But it would be a pointless operation even outside of that issue.

Honestly, the solution is

(a) admitting that there is no such thing as "perfect"

(b) making hardware fundamentally more reliable (ie ECC)

(c) end-to-end strong checksumming of data, and replication of the stuff that really matters

I won't go into (a). There are too many people who look for "perfect" solutions, dismissing things that help, and I think those people are naive, bordering on insanity.

I've gone into (b) extensively here before. No, it's not going to fix everything, but it's going to help a lot of cases.

And (c) is very much not about things like "read()" and "write()". Those are not end-to-end operations, and they fundamentally cannot know whether the data they are copying is reliable or not, because they don't know what the rules for the data is.

Doing checksums at those points is entirely pointless: what you checksum may not be the actual data, because the corruption could have happened before (ie when doing a "write()" system call, maybe the data was already corrupt in user space - you're just generating a completely meaningless checksum).

Note that checksums of data written to disk is a different thing: you're basically adding a protocol checksum between memory and the disk contents, and trying to protect against everything that can go wrong in between the two. That's an entirely different thing from checksumming when copying from RAM to RAM (ie writing to the page cache).

So (c) needs higher-level checksums by the programs that actually deal with long-lived data that people care about, by the applications that actually have semantic understanding of that data. Obviously you'd like to have some error recovery (which might be in the form of ECC, but honestly, at a higher level you most likely want it to be at a much higher level of redundancy entirely).

But that (a) is important. Accept it. You will never have a perfect system. Not in security, and not in the "corruption cannot happen" sense. All you can do is do a lot of mitigation (and the primary mitigation should always be noticing corruption).

Linus