From patchwork Fri May 31 19:14:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13682016 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDA2FC25B75 for ; Fri, 31 May 2024 19:15:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 079CD6B007B; Fri, 31 May 2024 15:15:04 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EA3AF6B00B1; Fri, 31 May 2024 15:15:03 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C82596B00AF; Fri, 31 May 2024 15:15:03 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 9C68C6B009E for ; Fri, 31 May 2024 15:15:03 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 499A84182F for ; Fri, 31 May 2024 19:15:03 +0000 (UTC) X-FDA: 82179643686.06.F36B5DE Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf18.hostedemail.com (Postfix) with ESMTP id 84B011C0016 for ; Fri, 31 May 2024 19:15:01 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=rfluF7TZ; spf=pass (imf18.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1717182901; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ytqvnfhrGd+4u+sIyyAk7no1rjiOuhOlGKkOQp3rWXk=; b=xuFLLRRPcZ9vo7NlKRxH1rZJNi/E1fpk7ojXIU3axd1+m0qZqlCSoGDjFeTtLM/guVBsXB bXCr/ztAEVCV3fFKhn/sQZ1UY082rJOpGjvlhgc/uGfZg4T4pG0lJktklop8fG/+jZkVEK rXhSeygHkPbvg1xTo593W74P9sXF5ZY= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1717182901; a=rsa-sha256; cv=none; b=p1ajZxG27btY7Rds7/G+Vr8VseSanMLeXuV/wt8X1miphjucrUjy8wz2rQErYnZAo1pEva OulJk1uHi7YbQVv/5fVJs0PbBX2vmNwizj1ajh85Pmo6Py4bwTpv41kXd1l5KZ7CILInvd dHppNm1ltU9RJtpSq+uw1aLy8JtvawY= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=rfluF7TZ; spf=pass (imf18.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 9DFF862E05; Fri, 31 May 2024 19:15:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C83B3C4AF14; Fri, 31 May 2024 19:14:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1717182899; bh=Mz67Iw49GR9dHuxCXZEK5DP7jtaPkYbVmfaXomUh4Hg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rfluF7TZUaUoGLyXwpABguT3qbLtGxJfRuvK1/sobxp2PtxVb1OvM+4f6W0OqHeBZ HVCzHLuNgSXNbiDvOWo9b7sp150CFJMu2u5Um36A0qhgQrBPy7TMnrLGv3uzbjkyag ETb5sbk1uj1K2LerZ6n2j87yVt5dO/HIggUL9fZR7Aul0NbBjm/n43QC1+Hv51nB1k mp09o+nVaHmN5D0x1KPcjGlapgB2ZG4WFgEWl5AlJB9c52+E8mPLywMYlQsclIHxnr 9KCd1BNYNPs9QuW+MPJzXFiKHsSxEdrofPeS5TkNIhK1n3PkfEQEpc0GwQ/T7EUEsr q8HVHOW9Ln5Yw== From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Jann Horn , Matteo Rizzo , jvoisin , linux-mm@kvack.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Thomas Graf , Herbert Xu , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH v4 6/6] mm/util: Use dedicated slab buckets for memdup_user() Date: Fri, 31 May 2024 12:14:58 -0700 Message-Id: <20240531191458.987345-6-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240531191304.it.853-kees@kernel.org> References: <20240531191304.it.853-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3128; i=kees@kernel.org; h=from:subject; bh=Mz67Iw49GR9dHuxCXZEK5DP7jtaPkYbVmfaXomUh4Hg=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBmWiGxTogF+aXNFJapX/Rt8xhEoMFuFnyE/DJdq wqt+/Xyp5mJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZlohsQAKCRCJcvTf3G3A JjfaD/9HhI1ZsSAtkAsPWK/ezBjLTmg9GWtl4cRE5dSCRoRpeonv9zJFzQSi/z6q8G0WsUdqG3O q3/OwvDkzuj5PVGBcnx18cxE+4jWy8wzjmDguTWCRaey3mtxit/8c4XHxisL60NntcKaMbwh1TN oi5hUUUDQgI71vHIiuoXRO7zD2LY7dCXiUhbTkKyehfUbQRNzSdc/2Pk73vDhtorWRkwDBJmAt0 uJkgJBPYxsUVHdzXRNgA49jdAloxUMLEOmlZE05GQz2kMjakueNT/8zW4hXJ7jhtvqRqOReYkWa CEnpQa2OzgwYHWFfEWJWI7MsyPy4M4h8Wy4r9jHIAPv1ZI/zkUTPZU9UmIpqDWi86FrEhYHDeqP 4CzdIm2QHlf9rFaFB3G8u+OmTO+U4UQPGxK10sZ/JNM5bmYPRvtF136Lz2cZZp6pDXpW5RIA31c pW3P212pGt3TZNiDXGRd6TG/m06XADFHeuA1H2z1/DCG0Pn0C2r1aG4jC/EWrlOH+81naGmWRHk YVXH7L3KauzmbodVlUZRHUYFlOFEtHjHjfnJWGZw1CIhpNZexJHeN8T4/Fl3NWTgqC6GdfKMkWI xvelqd86qCJCCvYtZVCbFr4MHOoTH1oyU+I8dvyKYQlqyqeJi07lpI6JnOevOTL03LyuLUsgq9e +5WiQK2W0zfBIpA= = X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: 84B011C0016 X-Rspam-User: X-Stat-Signature: 1ecfgwgtduaa8uq5w4t8g6ohngjpd4ew X-HE-Tag: 1717182901-783450 X-HE-Meta: U2FsdGVkX1+ZHucWrqibYhKh8DPNCQBhC8Tzv/0bKgaZmx90i/ZbXSJI/blDadENEOMjss7PS8/rdIFSAdNDkRao4sZ8OM0VpKk7LKKBT0vaMLWImavAWKvT9y2AAZc3CVYZlzfe8UkqjnjYfpcUaplyapI3Wm80i5hhG4+390QeD2XUZFLCMPGLt9VZx5RC2fZQKM9s2kDzYaAmnEyMslcwaivBPE7yTpkk614mvTwWsusUMJtu4RUEL101XErVt00fIHQIgSLJkIxYqcu6K0TU/5G0NeDl539ebNKWqWmHkeWTI1m8o/FiQeAslHjNSNYHDj7MLrQxYF9nxCi/G0UDVxBJQYil+9RW38c6cJwIQ/k5GeaEU4gKWK+u8zvW+YeD0evVkVmzyisoE+jvpB3wfS5jvtMNXkPSY9PqnnaZnSgbzVb6UC9CUhbiw031SZkkqduynTssJq41g9QAXbhAYLBRxxdFNJFBuVYOuhHjCiaHJq+bSyzmoDYYr5JsWlOEGJKBZzolxpRoNQlxXxR9JatbHO/G9TfZNvsJHZPrEqjN4wQv6lrrxzvYzc93g0iNLQnG9NAiUAXHp1FrtFY61QlyC1OaZkyac1g8vDar6hfYaZBxmzr1Ak3etQ5bvQsd03m+9RdDtj6TZgmTB+a1ArDPZ8KSoHVQyQYmEtqHuUYnaJ9pvHsv2ndbc0GBQa1Vo61tUUSZjDnLMoA/ffBdSZZ9mKRgIHeoVb9epQyGeDNs3thMUT8xCjvbk/hdlicvX/4RVCeaj51buMfOgHMmiupq3FbTPQAxhawJTz8GC9EHW+QiCDvNI714y/aqAa08yJKIWFr/AzJ+hGkBg0PSrSNUazqLQ5EKm/cb+RiFeuYyk17Yu8uGGalHxkowiyLZzzEROxkWMa0iMnJRFyEtRWh395FaTIAb5DpFrPPGFkTwMigCzy5YkidsEvhBIckYdIrrzXA0j40VlrZ qfEO8Lpe 4/pZONbBJdQtzRsoLWlgXBgAa/5/GdXroac4X1DPqTKypsP0TTuBJKJkG7M8NdMRFWGGVHDnp2YS4Amof0FdZcUyfVN2aEvqJhDgzhsxv+kNl+Qkq2DFFwJu/TsWRopejAic43tLR/GHEnkpjVRzgZqBXPJqKXj7tN+A/pRw/Fx1u3TFd5iCYkMjGcbpWatHOrh+hfKnRSbd4vwVQMV7dVuEN4Nl5JmZ5lblKpBGT9iLf342NJnY55bG0P+UVAaaxO6K+f+aEVk2uCIkqz2Levtzr2WvceJNthJFWVdtHgyhYuSzJnHKVsSBhL2+NsjwGo+6kezT4sbA2gMU5HgBOAyGTAVo+eJn5yrKvN6W2mN/67SY/FoMrcI1jiFHWpF71q3pJSoSm7158fuyrRBxG1+C2h99rYFiPerpJN80n2VuEdnp0NIjCy/AZ9ThxZXcQlQ93OYriOg2p/Pun9L8MhCzLswtxb7FD33S4aHOqvIUolo/241OOl/0V0ztkZVKP9i83TNQJlKBbJh590Sr7QYJJfQ9CbvpxLHIaIO6IX+21Mp5Xco2HXkg/n0KDJHc6DVX2F6WiriwCGWXieJpqYzShbVo4dx9OXozQJ+DFn1I5ZMJ159eGJXlrhhkbyHDUrQpepjDRbidRZDwF+OFGVIhTgcRRUJyPA1huYeREl5Xt0fn9wwaztPzbTVf6mMcD4oF8vHZcOVlaUcAYTnc+6a81LSErF5LYJb5eLKrfsq2MaVfq4KJXDem6cs8wBkSle1JPiFIS34u5S5wgdqr5fNqIlhxLaW6602Gc5mK1QuIYse4vtA8H9sQKsJfIFk7nodmcx52qbl9+jkE= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Both memdup_user() and vmemdup_user() handle allocations that are regularly used for exploiting use-after-free type confusion flaws in the kernel (e.g. prctl() PR_SET_VMA_ANON_NAME[1] and setxattr[2][3][4] respectively). Since both are designed for contents coming from userspace, it allows for userspace-controlled allocation sizes. Use a dedicated set of kmalloc buckets so these allocations do not share caches with the global kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in active use: # grep ^memdup /proc/slabinfo memdup_user-8k 4 4 8192 4 8 : ... memdup_user-4k 8 8 4096 8 8 : ... memdup_user-2k 16 16 2048 16 8 : ... memdup_user-1k 0 0 1024 16 4 : ... memdup_user-512 0 0 512 16 2 : ... memdup_user-256 0 0 256 16 1 : ... memdup_user-128 0 0 128 32 1 : ... memdup_user-64 256 256 64 64 1 : ... memdup_user-32 512 512 32 128 1 : ... memdup_user-16 1024 1024 16 256 1 : ... memdup_user-8 2048 2048 8 512 1 : ... memdup_user-192 0 0 192 21 1 : ... memdup_user-96 168 168 96 42 1 : ... Link: https://starlabs.sg/blog/2023/07-prctl-anon_vma_name-an-amusing-heap-spray/ [1] Link: https://duasynt.com/blog/linux-kernel-heap-spray [2] Link: https://etenal.me/archives/1336 [3] Link: https://github.com/a13xp0p0v/kernel-hack-drill/blob/master/drill_exploit_uaf.c [4] Signed-off-by: Kees Cook --- Cc: "GONG, Ruiqi" Cc: Xiu Jianfeng Cc: Suren Baghdasaryan Cc: Kent Overstreet Cc: Jann Horn Cc: Matteo Rizzo Cc: jvoisin Cc: linux-mm@kvack.org --- mm/util.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/util.c b/mm/util.c index 53f7fc5912bd..f30460c82641 100644 --- a/mm/util.c +++ b/mm/util.c @@ -198,6 +198,16 @@ char *kmemdup_nul(const char *s, size_t len, gfp_t gfp) } EXPORT_SYMBOL(kmemdup_nul); +static kmem_buckets *user_buckets __ro_after_init; + +static int __init init_user_buckets(void) +{ + user_buckets = kmem_buckets_create("memdup_user", 0, 0, 0, INT_MAX, NULL); + + return 0; +} +subsys_initcall(init_user_buckets); + /** * memdup_user - duplicate memory region from user space * @@ -211,7 +221,7 @@ void *memdup_user(const void __user *src, size_t len) { void *p; - p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN); + p = kmem_buckets_alloc_track_caller(user_buckets, len, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM); @@ -237,7 +247,7 @@ void *vmemdup_user(const void __user *src, size_t len) { void *p; - p = kvmalloc(len, GFP_USER); + p = kmem_buckets_valloc(user_buckets, len, GFP_USER); if (!p) return ERR_PTR(-ENOMEM);