From patchwork Tue Jun 8 18:39:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12307931 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40074C47082 for ; Tue, 8 Jun 2021 18:40:06 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id EA25D614A5 for ; Tue, 8 Jun 2021 18:40:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EA25D614A5 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id BF3C86B0071; Tue, 8 Jun 2021 14:40:02 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B7EBF6B0072; Tue, 8 Jun 2021 14:40:02 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 86CB66B0073; Tue, 8 Jun 2021 14:40:02 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0005.hostedemail.com [216.40.44.5]) by kanga.kvack.org (Postfix) with ESMTP id 398126B0071 for ; Tue, 8 Jun 2021 14:40:02 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id C63E298BA for ; Tue, 8 Jun 2021 18:40:01 +0000 (UTC) X-FDA: 78231421002.16.8A62BF3 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by imf27.hostedemail.com (Postfix) with ESMTP id BE9B28019358 for ; Tue, 8 Jun 2021 18:39:57 +0000 (UTC) Received: by mail-pl1-f173.google.com with SMTP id v11so2678336ply.6 for ; Tue, 08 Jun 2021 11:40:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Uwf15MYLwxoOU1qMfGZ6a+IKuws7ocGxDIxFsZ4OFug=; b=ZmhNQaEiRD+PqJ+xrZH8xI+iuIxofJdRY4W5A/5T7XGrwZdn/iYKbCqRjkoO6VyeJC 8iOK+dhExpTRhmv1VGWbtvi9J6JBjS6DXHKz9T69rq+p+sdxt0rTvOPLXXk01OUb6R0U HTSYdglOuWFKjcdgHPtRlL5/e5zFab4FEbXZ8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Uwf15MYLwxoOU1qMfGZ6a+IKuws7ocGxDIxFsZ4OFug=; b=uAmibBC820QrlMjPEUAr4RCb8V2sQFN8yaoTtRNafdXSudizt/J3mCAec3phR9gOPx KwMkxra0+o6PjiwGHtwTdGAtviMC+jOkBgWrj8fjgALZ/8ezEoA5jTouyL5yuJ1yaBSv ESNs0NvKVPIrJ7GyCxT37mv4S39Ly99g08cNQ51PcTfmztFz9ckPHX3CbytEjMxUaQop XzLCYzJx8uvPdfLf/g9wukQAknZoVzPv8jxi3/hfvMsuuQI9Eg70tz+N3Ik5/Dp40xof rngMrhj/M7Id4je9q4Sv8d/UzZkuHMZQpD4wvdc4BH1SJChkoKYfXHp39jTfwBUN4PvV FBKQ== X-Gm-Message-State: AOAM530J30DysJu8jLogKT0z4drb4Sd4s7d/VTbdKOnbotEISB+nlWo+ GEU8dij1Xpz4Xv+to0JAZg5+iw== X-Google-Smtp-Source: ABdhPJyIRKmRRu2AYmJbx93jMDBAJ+npfATbrE3k5tSb2maqGENQ2XEQjv+jCNUyOXMkz7bKz3mtwA== X-Received: by 2002:a17:90a:cf12:: with SMTP id h18mr26723016pju.131.1623177600473; Tue, 08 Jun 2021 11:40:00 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id x2sm6930010pfp.155.2021.06.08.11.39.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Jun 2021 11:39:58 -0700 (PDT) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Marco Elver , "Lin, Zhenpeng" , stable@vger.kernel.org, Vlastimil Babka , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH v4 3/3] mm/slub: Actually fix freelist pointer vs redzoning Date: Tue, 8 Jun 2021 11:39:55 -0700 Message-Id: <20210608183955.280836-4-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210608183955.280836-1-keescook@chromium.org> References: <20210608183955.280836-1-keescook@chromium.org> MIME-Version: 1.0 X-Patch-Hashes: v=1; h=sha256; g=258aaf7fc047e39c606cfd78c6cb30ea0743ac4f; i=9r8xlkNM+5K11owYVXEwhB43FxFLIosDS833zHgjUAw=; m=Uy+f2vNqhL2FSdVsV3KF5XKnxC9QUfLtorR17aD8dZE=; p=6aeBvOTccD42eyT82fqBR4aM+xkklg7H28x6pgmR2f0= X-Patch-Sig: m=pgp; i=keescook@chromium.org; s=0x0x8972F4DFDC6DC026; b=iQIzBAABCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmC/uXsACgkQiXL039xtwCZ8sw/5Aa5 oJlATMma0eyvLqBYz/VPZi0O91RhNhjLkzEC3UfMrsVk/DhG2h6PDnO70twLT2F4Pwq6BxupMP8xX vcQxlyw8m0wgL63mgczYCW2Y6zTP+nzGaTwjCY62voKzT/8KEaxt116eQTgveWgViqsdAU6KFDV7e xZDNsPPz8+y19OcDl4zHQUWmXkLOEComZnmT3AaNTHfbFRUn0k5NOpIK6vgB8mBQs0stN3PvBu6js 6Sr0L0eggxneKqkpFadWuW8cBlEXVHxGTqNxHgFFJv2GCWtCUsbSGqMhosJc05devWKzYSgzcjqUO +peNN+Ip7myqDGge3KlDRk9c5TMFxPpEsHrDfsBJHk5VGKn9JEEt5OoqGE2Iz3oVhaMfCuhJ+VB2S tWHHQqdBTHQOh4Ma96uEktGPlWhNGCnw+Z3Tyct6EjlnKQj/sRX+8xMGyn90p6UwXNhaE2ek1ulAC PBJeZOO9PhmVufmxx+WUUv7P5zV++PlVpIM3IWDiByHXwX8yO0z9qRN/ZTy/6LcpnVpb6YnFiRvAF N87lCQq+LykDFpMCpodukzVCgGB8+oilN7llyRY7j87jsg7Zip4MM5aEd/x8o7lcbIVJXJh7RbnzF OxZ3nLJT1mgwUg8HFsdx62qb8gFnNzT+idnsCTNZCiBxhtBlrXensTlmN+1wdsRA= Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=ZmhNQaEi; spf=pass (imf27.hostedemail.com: domain of keescook@chromium.org designates 209.85.214.173 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org X-Stat-Signature: weikxza1satur35zdo9njrm1mjtusq3d X-Rspamd-Queue-Id: BE9B28019358 X-Rspamd-Server: rspam06 X-HE-Tag: 1623177597-846603 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer), so a cache created with an object size less than 24 would have the freelist pointer written beyond s->object_size, causing the redzone to be corrupted by the freelist pointer. This was very visible with "slub_debug=ZF": BUG test (Tainted: G B ): Right Redzone overwritten ----------------------------------------------------------------------------- INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200 INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620 Redzone (____ptrval____): bb bb bb bb bb bb bb bb ........ Object (____ptrval____): 00 00 00 00 00 f6 f4 a5 ........ Redzone (____ptrval____): 40 1d e8 1a aa @.... Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........ Adjust the offset to stay within s->object_size. (Note that no caches of in this size range are known to exist in the kernel currently.) Reported-by: Marco Elver Reported-by: "Lin, Zhenpeng" Link: https://lore.kernel.org/linux-mm/20200807160627.GA1420741@elver.google.com/ Fixes: 89b83f282d8b (slub: avoid redzone when choosing freepointer location) Cc: stable@vger.kernel.org Tested-by: Marco Elver Link: https://lore.kernel.org/lkml/CANpmjNOwZ5VpKQn+SYWovTkFB4VsT-RPwyENBmaK0dLcpqStkA@mail.gmail.com Signed-off-by: Kees Cook Acked-by: Vlastimil Babka Link: https://lore.kernel.org/lkml/0f7dd7b2-7496-5e2d-9488-2ec9f8e90441@suse.cz/ --- mm/slub.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index f58cfd456548..fe30df460fad 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -3689,7 +3689,6 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) { slab_flags_t flags = s->flags; unsigned int size = s->object_size; - unsigned int freepointer_area; unsigned int order; /* @@ -3698,13 +3697,6 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) * the possible location of the free pointer. */ size = ALIGN(size, sizeof(void *)); - /* - * This is the area of the object where a freepointer can be - * safely written. If redzoning adds more to the inuse size, we - * can't use that portion for writing the freepointer, so - * s->offset must be limited within this for the general case. - */ - freepointer_area = size; #ifdef CONFIG_SLUB_DEBUG /* @@ -3730,7 +3722,7 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) /* * With that we have determined the number of bytes in actual use - * by the object. This is the potential offset to the free pointer. + * by the object and redzoning. */ s->inuse = size; @@ -3753,13 +3745,13 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order) */ s->offset = size; size += sizeof(void *); - } else if (freepointer_area > sizeof(void *)) { + } else { /* * Store freelist pointer near middle of object to keep * it away from the edges of the object to avoid small * sized over/underflows from neighboring allocations. */ - s->offset = ALIGN(freepointer_area / 2, sizeof(void *)); + s->offset = ALIGN_DOWN(s->object_size / 2, sizeof(void *)); } #ifdef CONFIG_SLUB_DEBUG