From patchwork Mon Mar 4 18:49:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581011 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8A5DC48BF6 for ; Mon, 4 Mar 2024 18:49:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EAA306B0092; Mon, 4 Mar 2024 13:49:43 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E599D6B0093; Mon, 4 Mar 2024 13:49:43 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C369A6B0095; Mon, 4 Mar 2024 13:49:43 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id AFEB66B0092 for ; Mon, 4 Mar 2024 13:49:43 -0500 (EST) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 81AEC1C0B04 for ; Mon, 4 Mar 2024 18:49:43 +0000 (UTC) X-FDA: 81860245446.07.D67BE7B Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) by imf01.hostedemail.com (Postfix) with ESMTP id B16D04000F for ; Mon, 4 Mar 2024 18:49:40 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lPvN3MSQ; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf01.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.181 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709578180; a=rsa-sha256; cv=none; b=PiuQEKmHs+M5LZ9Dp4kXw5rttq/sc3AegYWvaqg2O2SDQgUbziawMyrlMkALroiNk0A4J1 jI19ciGkMVR9u9kIaKaW8DjSyTO7bMSyLfZroT7KwhEz5ogeoNs5LvGxRRRF1QVOD3K2Vx rX0JCeoAgzlgtrsW2vWOVlXLZN1x1oQ= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lPvN3MSQ; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf01.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.181 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709578180; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=awxpusEpwcvQL0W6vZCOnQBW4rjYdtneyXEUJno5voeNJ3r7p4eW7VaEtuXXcq9+aTG8Qy E8gDUw84i7HZQR2xHS+JtKXnBNYoGbURoN01pBrJB9SdH5vGlktXu37Blxxl6kuakTgua/ 2sQlACkvU60e/zz9vRIXMF+peRqO6Sg= Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-6e5eb3dd2f8so1489572b3a.2 for ; Mon, 04 Mar 2024 10:49:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578179; x=1710182979; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=lPvN3MSQRlwEboq8pcMui/R54O5+i+pEJ8AUs43sVswveem4ROp4PsogpzgepNhiWj HrMqOR62YeBbDC1XczTQa35DHiIh59EgvSx06+/PX6uQOpGMHb1UB6B/QatF4UwmlMFC u8ydnFtBEhcm0VYpHa9Qn5HNBK7ur6eycXp+k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578179; x=1710182979; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=gq4sd2NNyQTcO9foWkytR2QsI19+m5PqYv6TuTsR81CkHK0Rd+R+8U3Oi9kwejD/uQ AWmodLhpQ2nTGb8S0gzoJRBYAmq+U6ILmgvTbh95ijYvuk2eSKIM8HYTSW4j8xBfFlcG 5FV1NadcT6sgkfTv04h8RQzvNfNDDUtZFa4amE79lAKRAAzq0Fm8duUmyvLtnAbP6qcl FsnjNAD/N9DUmnWjBDyvegb1a0VOWlLDz+r/R59ViltQOD2PvV6pKjX2fEvor2fbvghT ps/oZl8HxFRW5EHmkJ3DDBrTC0O0jhfS8uGv6WMLDh/rlDw0WYqCnHLjdFZb4SjUs1i8 JRIg== X-Forwarded-Encrypted: i=1; AJvYcCVWvO6SFYUDFXXFoSTvh8A/wZqr5EpBzHH/QMABwFTASiBaHN47LL8slN1waL6Sc7hKrY8W+B5X5eGRhm5Wc5bLcxk= X-Gm-Message-State: AOJu0YxT73RIrFvcRo1N2dMl4wl+/sGDZKkbWWrM3vF+di5oGfP367BS M+xu3XC9JTYCtaKBnpJN65WUGED3kyQtiEniGHX3opJHKlXiVPFl8s286pUQMg== X-Google-Smtp-Source: AGHT+IGILIudDoOhkhQCWTyG9z0DMQjNf1OD2uCgU2558fLWKJP3m4244pk1XqBrh1eKa3auyU02eA== X-Received: by 2002:aa7:88c1:0:b0:6e5:5425:d914 with SMTP id k1-20020aa788c1000000b006e55425d914mr10540158pff.2.1709578179470; Mon, 04 Mar 2024 10:49:39 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id r27-20020aa79edb000000b006e60c08cbcasm2881132pfq.50.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , Christian Brauner , Alexander Viro , Jan Kara , linux-fsdevel@vger.kernel.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH 3/4] xattr: Use dedicated slab buckets for setxattr() Date: Mon, 4 Mar 2024 10:49:31 -0800 Message-Id: <20240304184933.3672759-3-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1560; i=keescook@chromium.org; h=from:subject; bh=IcLElAry6DIoRKKwJQmpd7ju+FKDVUugrCBgj64Jc1w=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8RUV3Nml6+beLYoX/gI6MaxpEQEieiV1Pk LAMHZWkh1eJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A JgarD/9HvGby2B7eoqRlayCbyDlLBOSIiVV2Bq+vUUsC8Ne0FV1zyqgFRQrXbQ2G6VGoWXimSlm M1jvsW/Y99i2kQDWqeDEZeZf+LehlADDm5Vd8pmJfMMgX19BF898FQYPT7s7OKOxOJ4T/GuE1Kf f8BRgEGLrWxyrMYUyG5/wFYfmfEzazDwiU+A/d2eMxhnYFT6e1elFQ0FweaUabd1+ZCJwV5UdWh HIyGFxL/YTavdVnf68HYBNALeF2lzUERVyzafZOv6WzhMzem7sDreYdkBpWwU4Nvafa5vCB+mCZ kz+tSe+uPkTDLUvM18O8w9hPQ0ywaf1CFBDkCciseVfUKVnH06WlWb84AbCwLv1KSDl6ipWRLxU 84NhknBpAY4fgIguhU0kDs83NhdIl/kn10T/oubIkmY5wdavroHRaFjSlkw/VAeVdJCOOH+U3b9 AJDGgUmwEUlmq7b731/mixhLBrz0CTKq8Aa59nDba3ji+Utrd7I1HKHwMPTcsPrBIVtK2QspH+t pcBzTrTkEuaW7vRD41WXoqxhSJ+mUK3+SKCFafsj0ZaMq2qMA977BazfKFPlNrWRRWzRrteGmk1 Q8c9m2anBqS3EOtpP7bZ2OHyh5VlDQiLJP6Mo78p0Tkgsf+LU7XH1gWUSibuhbnTREFTie5DhAK x63js6NDKJKKoCA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: B16D04000F X-Stat-Signature: t8mind47nbf473qqs1aysxuey3xxkrho X-HE-Tag: 1709578180-795078 X-HE-Meta: U2FsdGVkX1+bgEzNfJdTONhKcGY5En9P0HsKL431zQ/aDqQsq1cOGspKklOxnKcTz4TUdLxcspRlGm+XuRYWCtFK9T44AMr2CHJRTZa03MnYtLrKBkUqA03lLu7YqoNyzYmgk+NFIZQTVaSPAw625lAyFrsx+pY3OJLeDgmG9DsRIR+SHVUM7tHmUcCr/O4JJjll37iMObjL9Rbl8C9c6pAqqQ533R1D4/XLXhPZbckZqIyV6Mihf7dw4RE2lbGJSnvYmCR6F7DDcpxhOxgRYD8/ydv+PzEOBfA8n1MfL06JAWWV3TQtSsfUpvCsHqoI40Z8jj8mDrxeE/MtD3mPOe9qLfSgecxKN2aCouKvZTuyHSe/lYn0g4b/aW8eWdpnzh74/zmezE5CLHY+ut5cyWKysp450b/Piz/MXBKHcidpfNTSaPrBQl+y2vsQ6V7muj9gpZg5+sgOuxmwS8lgzshu3eX1vNrxep5qaKjeQWZx7lcGAYlMrnzwa3ucrOhFpjeTRtLNFZTzFMByycMkwds0VKB+rTiKKOKNF9peaH4Qoytb1GV4rrjVoMWM2lnWhr+9cVsVfNLmGNaXZb1frP+apXILlsSxBc07/rLde6NDXvuddAuwge33ZO6xbdWXJEYVWoT+MqEtDkRyqrH6RNPLk2rH04+xOAeqCpBZ1AHRb9WDYI+e17XjfoPjywax9CV79k9fU2XfqrxF5XNRECFT1u3osY5kHDEGDBI6mlVCRB65VjVGiHKZCSN55GsNB3a4tmSA7lNKS6W05GoTPE2o9FuQsd3WUGyweel5NUTkuWkPxZoUYrP01POyj8LcdkU07/B++8uIlHnlsjD0lYVyud+zfl5cVRWWd/yr0/NJ72mf1Crhkbd4avTcHuNQ98D7MtR+4b/TnoKsnUSTOx6qof/ZwIV2A3Z22LqusEps4ESMND6P4g/ne7XgpPJqe9irLGJrCwg9mYUSVIY TQjt3Y/i ifJt4DV4SMnQwsgqE9FPyPepet6keKQZ1exqlh1fxZtf5Uoo6kntLB+M2Nf71+joyy8iFN0HwE6+KmOhOHl/rBshOczG0CpRxrvCjbWcHokjxhCZ8nVRO64YVLXGmDgxJma/Zl2o2U6rRNsFFUJki91DdVZYmT/5TWjZa6YhTT8isDyKJMzeTuknDk/dOf8B+KOzh X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The setxattr() API can be used for exploiting[1][2][3] use-after-free type confusion flaws in the kernel. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. Link: https://duasynt.com/blog/linux-kernel-heap-spray [1] Link: https://etenal.me/archives/1336 [2] Link: https://github.com/a13xp0p0v/kernel-hack-drill/blob/master/drill_exploit_uaf.c [3] Signed-off-by: Kees Cook --- Cc: Christian Brauner Cc: Alexander Viro Cc: Jan Kara Cc: linux-fsdevel@vger.kernel.org --- fs/xattr.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/xattr.c b/fs/xattr.c index 09d927603433..2b06316f1d1f 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -821,6 +821,16 @@ SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, return error; } +static struct kmem_buckets *xattr_buckets; +static int __init init_xattr_buckets(void) +{ + xattr_buckets = kmem_buckets_create("xattr", 0, 0, 0, + XATTR_LIST_MAX, NULL); + + return 0; +} +subsys_initcall(init_xattr_buckets); + /* * Extended attribute LIST operations */ @@ -833,7 +843,7 @@ listxattr(struct dentry *d, char __user *list, size_t size) if (size) { if (size > XATTR_LIST_MAX) size = XATTR_LIST_MAX; - klist = kvmalloc(size, GFP_KERNEL); + klist = kmem_buckets_alloc(xattr_buckets, size, GFP_KERNEL); if (!klist) return -ENOMEM; }