From patchwork Mon Mar 4 18:49:28 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581007 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15460C5478C for ; Mon, 4 Mar 2024 18:49:41 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8407B6B0088; Mon, 4 Mar 2024 13:49:40 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 816396B0085; Mon, 4 Mar 2024 13:49:40 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 641A96B0089; Mon, 4 Mar 2024 13:49:40 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 5493B6B0085 for ; Mon, 4 Mar 2024 13:49:40 -0500 (EST) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 2A125A1117 for ; Mon, 4 Mar 2024 18:49:40 +0000 (UTC) X-FDA: 81860245320.05.0205E01 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by imf04.hostedemail.com (Postfix) with ESMTP id 7729340006 for ; Mon, 4 Mar 2024 18:49:38 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=KzlLguVA; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf04.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.176 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709578178; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=wdLvSkRRcYIrR92tCDZgEdSw6ID8B6Ukmhsojy2h3c4=; b=Fm5BlDJHULF1wEtbiF7LtbsNexSUFUGy2QBm6qTLbFXZC4XnMBG2FmeS0i5i9FQJv5Gv/c MEC5OKUiW+89tbCLbFlxSVEIO7sRkXBHTinznUw81ng2wJj8x/x/U2ul/BqO3W/lMD1O0s pxTqYil3lRxam2i2QG9lfnEaCmnnNw4= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=KzlLguVA; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf04.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.176 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709578178; a=rsa-sha256; cv=none; b=4fKtXKa/MNX4IA06kdc/ZQH2OHs55Zep/RIUmKTcWploILuT3RnFG4hPl39nvXDqoDA2rT 2bckchM7NpdqhDu0KIm3q84yPIX8sGFlmIVn0zB5c9DuVfc/LGPbD1xsUeTYIcwngIHl0n oxU59iXB3HVq6k4+xQWo8Efp1uAMVBs= Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-6e6277f72d8so779023b3a.1 for ; Mon, 04 Mar 2024 10:49:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578177; x=1710182977; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=wdLvSkRRcYIrR92tCDZgEdSw6ID8B6Ukmhsojy2h3c4=; b=KzlLguVAooQ+LRrC8BaNuKAa5nJ0ReNhD+Re6WWBOIkm/G6WpOdmr8Us1B4xeXILtp xPQGA23RXlrk25n9QgSR1p893Y0o125IAs/56dD1DXOu9M0WGWOA4123Gi5vd3qYCMDh 7bmfX/PJZrqKkSghT6voHTMQG3k+kN0bldsyE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578177; x=1710182977; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=wdLvSkRRcYIrR92tCDZgEdSw6ID8B6Ukmhsojy2h3c4=; b=Jx+dpFTLYrigNTXD/VlOB6dWAeUz0I7pFBYSoZ68699TvIEYFn5o7b/F6+lg7kvKjc J87i/3JQSclGSS5WhgsxRQ30PecmvRqMI2/JJ4WM9ODdaLVrMYpJKlP490im74wqmSQ8 yJzDXj6mbGo7BpjroERWsClLY24FevgaZfdEX1n2Q2mx/SjFeenjvZ5bz3PAruj6PfgM ouDIh8QJJ3Gm2QesnqwtbkN7jOVrKR3MXR2VwoTOqnZgTn1Dq0mhYWULy4n3EmwMR+E3 NV6mxNwsUxUh+y8EsACTG4VZJyzofTSGHLbqNAvXxgrDzwgQnAPc67aW/rWK7yxaInuV EhnA== X-Forwarded-Encrypted: i=1; AJvYcCXO3d4itUePXha+rKXzzvn7n3SYPekH9FcNYG3I3XRdVbvmK3mYs5GcUjB2qr1WQmESx1+u/y4Rx1iVwsgmMdfw5+A= X-Gm-Message-State: AOJu0YxRWszyYJgWmFbU6rMtgSHcGF/1XJHG2dY53XJTvAySXNUSi1MZ pS9M5WLVOkyWaU/IM2PwsTM8mXCRBCqVp+FY/Wu3oCvtmkNK6EfF7frMnBk4ng== X-Google-Smtp-Source: AGHT+IHtNnKRvWzISz04plZ/Sn4VuSsQpitQzokIytXUOscKGTQn7JeB5Fu2kWiz62axSJe5xomkrg== X-Received: by 2002:a05:6a00:3908:b0:6e5:a96:6286 with SMTP id fh8-20020a056a00390800b006e50a966286mr9606526pfb.31.1709578175764; Mon, 04 Mar 2024 10:49:35 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id x7-20020a626307000000b006e624f5c866sm2059172pfb.145.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Christian Brauner , Al Viro , Jan Kara , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 0/4] slab: Introduce dedicated bucket allocator Date: Mon, 4 Mar 2024 10:49:28 -0800 Message-Id: <20240304184252.work.496-kees@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3623; i=keescook@chromium.org; h=from:subject:message-id; bh=Z625OVS2xp7R5VmVOq8oa1wppYlZ30y7U3WLqYCRayc=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he70IwCoMgSCvBAjUKwWeJz01b3BvWIw+IZn NkFBnkbdrmJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXuwAKCRCJcvTf3G3A JvLUEACOIeAvgkaKb4LbQPberShJfvihoE78bYC2zvaEx0MTsRGFBHPurFQpeBPK1mKDI5nhzYL r1/7AZ5cVLPbrhQI/v4kyrlZ4fuDf5jzh3KsaRLSf/7bl2hdg1+ZGkcT8WX1cKfv3l5jKXeXUPv 0J2ay6PQbYAOCSoW3lY1o55Gkjn+2F3u9SRtVywyD1pC4KJxpy/Ef40p7xaDWjtcB0Y2ytY+Uxd EiJoN6mPUxdwnZ4LcTWbKRm7XoCaI/Dh+fIE5S+ZPclsmabZFHsGIY2Dw1SCkggBXss6ypNQfL6 rexlpzBZj7tc5iLwhXroRl+jJvJfpU0L7/gJt/KrpffdUpj3Y62pVHt07cebOdCKuz+WLLIvzu0 CEwIkm7gf2oiwzJdzm9fzJpojjG+p7mTqb7Wf/Jv26soM5Q/EQsZf2S8jPq970mOrVSEQ1WOSFj kTyk5At7MJUTo5ZdUG3bzYcnFOeg9kpynAxCUT3SPlvqoMl1cEGzsRoBjq3RM1Y71+QKwerivQU NNfvBqiNdaE0X/o7wOd5AxOGTbeBwXXx+SJVeMzvl+ysx3uT7mSN394vPEiCa655EmUxLxzDWaR J7y2dnav0uSekT2i9vyMZCWBhU/fczOZAbzJbydLA3zwJEFT4eFTUOkGgV+fSVTQx5tvoo6mOue j/ujTw8 SiQNFfrw== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspam-User: X-Stat-Signature: bn4s3qop8mt6tji568by8oqj41topzg7 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 7729340006 X-HE-Tag: 1709578178-263159 X-HE-Meta: U2FsdGVkX18WICyuxxAz3k7GpjQC4co2xBX52/xcsK5kljPvaNOZED1mRh9uo1P+llS+TF1MoWvcAJ95AI6eF+siGb88rFShWyF0aZcidFjwYnkTSPzlcUxQnqPqHNPNJ9ow8ECgWO6MAYcqp800d9NKKw0SpzRbkQqfAavhQtBtGJ1h/cuCvlVTTnCkNzZ1UOP8P+xJanh3duEOWp/HGxEaGN+MlLpFd6x3rNA0+563HoF/S8zIFtgkCwSBwV5MCXNs7fzkuX7RadnZUAIsfi0ZRzvHxfdJaF5FXWEd/1LZWEyCTTdpPwXjfv+uzOC8MVlwDcGLilvFDA4p9Rwc1KVg1Hp94NGkAGFks/NfY13CHsQg25kJZF56PM9qkkICb1xWS6siEx4DqZsDXhi5Ngi0S/yaK6VtYbIqiHgKoi1cOgz06QQdjxQwsEEDQGQ2GYaCQ/fVFNJVUi88yJdwRqQ8UitQfL5opA2MTv4+ibqDhJkfrXFcSlBoiuIjPxbf5KJhRNVyZtKJyHeW0v3drU1hEiwW/8DslVTwbASSToG00k6Rv83PpiAGdL7ftbINrUKPtYu8dBJl5czq7mzjFqIXXXK6bXBHauDj71Ck+Z1u6S2rJH86VUQ8u3QKHLyGMhVO3B13fNwo7a3XBT5cMpUxa9MfHB8jGVDrKWqjBkh3dyWV6lMXgnkYFNErDAaQYZ/qT6RfdxU2VGJlYZqGvD1COx8p6GB/t5QDwyRXcMcrAHkMVih2yq+n3kwrRBxzy8NUmSNoyVZ2D60WESCmTuOe3pZP4zF7Qa0Bx+VbsTVKEYGzmMIMyfN5ja9aGQ3BlBCrxlZTQUCcgxItVNlpzhDZfYBUfdp3w8Ss33AglCsJbTd+PC/nFjQEVp3rC6H9V9A3F8pLDtNFy7tEw78muPRJc0Cn1C/Z0iwM120im8OZ07ySm9KEfCCq57zVt+YA/TEDE8iNXQedXHzEG7d KLwOacN6 FY5R1ZXNR30iR7hmaDupFgn2xsD9KPCksxcnRqxtjt2mIZRLT9lyMuTeYiZ47zpTckhubgQL/QC1djpbELEKiigDvnVS0UgJVSB7f8YIxWBrih9qZ8PUtuxKtc7Yu8t2TXhSwq06LSRYjGkKvEMBAN8cQzQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi, Repeating the commit logs for patch 1 here: Dedicated caches are available For fixed size allocations via kmem_cache_alloc(), but for dynamically sized allocations there is only the global kmalloc API's set of buckets available. This means it isn't possible to separate specific sets of dynamically sized allocations into a separate collection of caches. This leads to a use-after-free exploitation weakness in the Linux kernel since many heap memory spraying/grooming attacks depend on using userspace-controllable dynamically sized allocations to collide with fixed size allocations that end up in same cache. While CONFIG_RANDOM_KMALLOC_CACHES provides a probabilistic defense against these kinds of "type confusion" attacks, including for fixed same-size heap objects, we can create a complementary deterministic defense for dynamically sized allocations. In order to isolate user-controllable sized allocations from system allocations, introduce kmem_buckets_create() and kmem_buckets_alloc(), which behave like kmem_cache_create() and like kmem_cache_alloc() for confining allocations to a dedicated set of sized caches (which have the same layout as the kmalloc caches). This can also be used in the future once codetag allocation annotations exist to implement per-caller allocation cache isolation[0] even for dynamic allocations. Link: https://lore.kernel.org/lkml/202402211449.401382D2AF@keescook [0] After the implemetation are 3 example patch of how this could be used for some repeat "offenders" that get used in exploits. There are more to be isolated beyond just these. Repeating the commit log for patch 2 here: The msg subsystem is a common target for exploiting[1][2][3][4][5][6] use-after-free type confusion flaws in the kernel for both read and write primitives. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in use: # grep ^msg_msg /proc/slabinfo msg_msg-8k 0 0 8192 4 8 : ... msg_msg-4k 96 128 4096 8 8 : ... msg_msg-2k 64 64 2048 16 8 : ... msg_msg-1k 64 64 1024 16 4 : ... msg_msg-16 1024 1024 16 256 1 : ... msg_msg-8 0 0 8 512 1 : ... Link: https://blog.hacktivesecurity.com/index.php/2022/06/13/linux-kernel-exploit-development-1day-case-study/ [1] Link: https://hardenedvault.net/blog/2022-11-13-msg_msg-recon-mitigation-ved/ [2] Link: https://www.willsroot.io/2021/08/corctf-2021-fire-of-salvation-writeup.html [3] Link: https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html [4] Link: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html [5] Link: https://zplin.me/papers/ELOISE.pdf [6] -Kees Kees Cook (4): slab: Introduce dedicated bucket allocator ipc, msg: Use dedicated slab buckets for alloc_msg() xattr: Use dedicated slab buckets for setxattr() mm/util: Use dedicated slab buckets for memdup_user() fs/xattr.c | 12 ++++++++- include/linux/slab.h | 26 ++++++++++++++++++ ipc/msgutil.c | 11 +++++++- mm/slab_common.c | 64 ++++++++++++++++++++++++++++++++++++++++++++ mm/util.c | 12 ++++++++- 5 files changed, 122 insertions(+), 3 deletions(-)