From patchwork Wed Jun 19 19:33:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13704462 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 92266C2BBCA for ; Wed, 19 Jun 2024 19:34:13 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 47A886B0453; Wed, 19 Jun 2024 15:34:05 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 439DF6B0454; Wed, 19 Jun 2024 15:34:05 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 20A466B0456; Wed, 19 Jun 2024 15:34:05 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id F251E6B0454 for ; Wed, 19 Jun 2024 15:34:04 -0400 (EDT) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id ABE6280870 for ; Wed, 19 Jun 2024 19:34:04 +0000 (UTC) X-FDA: 82248638808.07.772FC54 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf06.hostedemail.com (Postfix) with ESMTP id 5B11D18000C for ; Wed, 19 Jun 2024 19:34:01 +0000 (UTC) Authentication-Results: imf06.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=Pc6m2Jyd; spf=pass (imf06.hostedemail.com: domain of kees@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1718825632; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=0O4o6NAnz0ysmR26cLvbnYF6BoQ6dImcUKE4nmSsKcw=; b=4IxEdry0mZGWJ3WTxQfgfMOGh6LhV3IPTK3/TdkqOxVHgb6XdL37mkIWnaayORLpiirSKJ 3/ADIalOBIhS92XSx3BTcQzzAFA1TChS3+qfuJ0JMrxjLGxvE7VEaDDCnuyuP3mWOR3ImQ TNaNReLiekHoJTNxLv8wglHkTCVJQ0k= ARC-Authentication-Results: i=1; imf06.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=Pc6m2Jyd; spf=pass (imf06.hostedemail.com: domain of kees@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1718825632; a=rsa-sha256; cv=none; b=yoH/+p/7uqW8dpZmomEojrjAk0NClzIvd+CwyQC2CbEgGN2bBJ7mcQ4tD96MVwGStYEoaX be5LoC38FZUlcg2JYkccHx6naUgxFOV1C0YV1Zrog54+oG6m2icnFIl649GqpZng9+YhWU xy5TfeKqFX7XfdYqe4Y9AdlUScwPejU= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 1487ACE21CB; Wed, 19 Jun 2024 19:33:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C6FAC4AF0A; Wed, 19 Jun 2024 19:33:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1718825638; bh=LrnolFNHWclGZ9p3hY/QGRuJsr6+6G+8GF/8xJCY8DU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pc6m2JydDigHX1wPdvV7BSO6pjR4OiuefHdkKa1fdpttENlQLKGuUfbGFFSu2l4Lm lQD5iAks3gvBoAIfaXZXsbn9df6WJYs3vBKiEbv3bJ4PaaLahoIa4QSNZ1SYfuLbBH EC/g9SUx1BXID0KIUyOFIJTu1RoIyozImXz+TkjeVy0SusKmCLRASggim94z6rYRCM tO4C6jMpK8ZWUlJKguJ9sfCfZZJc1MVWVRiBXSV+GO5TXMdXWOzrdcFw/b8i8cgg7U lBK0Q0+bcSuO5G7slNZJMYU9DBvzN/fxnRHAqOvcn3r1IAoqVZP9OzadrVNBk/NTEU Fodm/pnVMavLA== From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , "GONG, Ruiqi" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , jvoisin , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Jann Horn , Matteo Rizzo , Thomas Graf , Herbert Xu , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH v5 6/6] mm/util: Use dedicated slab buckets for memdup_user() Date: Wed, 19 Jun 2024 12:33:54 -0700 Message-Id: <20240619193357.1333772-6-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240619192131.do.115-kees@kernel.org> References: <20240619192131.do.115-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2799; i=kees@kernel.org; h=from:subject; bh=LrnolFNHWclGZ9p3hY/QGRuJsr6+6G+8GF/8xJCY8DU=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBmczKhEAWYa/Ji7QXOW1GAYZ9rnB+j1DB6dbkqF TcWKMWXK8GJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZnMyoQAKCRCJcvTf3G3A Jna9D/9jn8FgmhtJGIsF1k6FXqxnOb5H/Edjil/UGnza0ThNC5KYFYysA7NmGEt75u5Ul8yTo/m mPSLD5BsKR+jO9ra+Jb1otzerSK7RPkiM6Imdxr4fUVqJRDIyZfow5kmiqU9kP3XohZkW6L9tCf Gg3Gf3IyVqjtN6r7kMQfjfEwb0asp7l19n+RBG+Y+rCjuwW9f0zVuora95LsN+puXykCTSHPd8l triyydYzJHXgpSTHex+MpUFovzc22Spf+qmwDTaHqtewlJLtF0Yv2hU8zovuwGlpfr8ByOElpfK Vk+S54XYZnxOLQ67p3popKVW0MElvIx5m8o5iUKZDmwhhLvPBOzUH1bT6we+7qxY02Rjs8l7tcq 2WQdGuzFjXnYo2mAqRN7l7S7Cq1nPwRpwtPoUinjqbvdFIV/NRq9GABynRSpDqxH5qrbas9689/ gvJkHTXbL+PSnY6Qs32jdRqdMuCqHzXkPa02gx1uuVpAPC8z9C0JsTzVOz30ZPQ9b0RmeBt9pE6 lT0nq+2zyjP5Wa+1oEckM/FhVlBq0s4VsGGABVI6DWi7oWRyz/ZZfn5gV0N4qWgfnHJalyM3cFC 3O6fBUVeH3zAlDMwpz+DEypq18nKLYt6AtEq5WMurqTQR+ES3H6DKAtjc5xSYw6hrbgAMWMSOLR smdpkS6OJkKmNzw= = X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 5B11D18000C X-Stat-Signature: ta656zct73qp431hwt3u86z1ty3gif77 X-Rspam-User: X-HE-Tag: 1718825641-499173 X-HE-Meta: U2FsdGVkX1/pJ+zRwQV9NwhyTfrtnfsH/kIKLbnnRK2by+52JQbzFi1KBYpcl0Bed+ItnnYmLgjm7FalooAaKeBpNy929I/OJA4Do4GfrlZAYMqDmrVe+guivVKVr4aFZnDHXQYme8a55qMclEtkg1UfiI2RNFWxwBAGkf2YresI8MyaMmDv2Gh9lFfyulZz+uvLlwRvSLxWlell1AaA0DaQkgl3kpEh6QBZIPAWbsCPSUwUxYrnZ7tJBQCmI/rUbdKlmMOUpBaKsrb4dsEFgNUoo5+uGhjnCq5S11Pwh+uckSta9TGwYfYKh18di6tN8G2drdTIvkLPPvvO8qaGobGNwXnmJNhfqy/tuSJ+rkvLU33PT8xfUaCcgYPyQ4Qh4uRvTLmEp5k46zS8ZJui82cdPuI0h4iKTmZP4kdk8k186BQZwzsb3iph74VfqjMvMz+wszL/xg1mDglvfZiSBNtSsVtUxj+T4jTDpEb2/JMQOZ/o+tjiCKxhlILGcmrrgbjO219vuuuLbQNDkYl+lOWsAWB4YBlII6W9KtDHL6EHSL5LdwHsM/sBnQFw68tufHTzymJ0n8cfDoKTg/7/a4FKnYRA8OoqHVxM0hkqAV3Z3V/Y2IQ6q7SZlVgxoE+XBitWIWaoSNM2Rd0bw+A8mgZHsqtNdmgRqL8XvCsXtMau+YpGYMTqAJHyoNZoco9vbEohHWa0VRwZI40V0KrmOPf7yTXWRyPncwTsjC8FZ/zkbaADO+hYI+a1es2tz/Sm7zrhmUpzRGqN6ejdYm9zfwZtUcreE7tmn1odxO2jHmefOPGWxXzDIcgj4++zDgyA2WeFYWgIG1dgIPlcnS3H3M4QwNF3zaUv0wzXidIb2lfy5eyLzaIdVOS2srdTLnjHVEAmszyUDdsh1Lmzh1SCF+/j7GRJwn+FCle2hvbMO+FQth+NFTsppqdl5djT72XJi66xVkZ8N6QRaceXOyF Wy/msEVH 5lqo7L8Mo26Hh3AyFxdBMdIVb8J2qwgB4xNoM2he7oTb8S1yMNRBd2jVtvSCugXp6c6eNWdnDIFk70GDOX1HuN09Y6PiE8/OhJWgjetpZHvIbs499nBWn+TPfgyLVaCEi4X/gAESvI1Jq7CQMOm5i3bzGi7J6JpEjApKBJivGkeGh4SiBCgVdv9h1IliWjzMMyVyIwO5EXCxYBM2wKe9qub8u8Jvame+tJYsgU6gk2EoIJRYy5kiIV1/5Xg8qNaSJXEpBztIo4RGI1SFJGdmUNBXq3BzIJkGSjos1E7KgnA99H3KEck0T8C2JfgsXB78CdkaTaszDiKbXT9X6mx7/IS6HbLNT2wSEUodKej+KVMawf2vv7aDE51zpzskpp3GVxmFNfMb67YFbRL66ZmuK2WZZBlnmgtcw7/iJmsI0op5c34urK9O4r2rLY8Kx6ne5r+YzYgMW5WvlRZFEBVg8Qncm/ip4zXhEfzvHTSCD+/MSpM+JoMkLTv2eMP6WEXSs5htkxzzgHIwojcdFIcyod5lzlXIhTDH3jWT3o2zVABJoUogkjLN1dk/JPcu5w07I75ytq646RQ8+BgWCkwTXyqA0/MEo/0+Tj2lq X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Both memdup_user() and vmemdup_user() handle allocations that are regularly used for exploiting use-after-free type confusion flaws in the kernel (e.g. prctl() PR_SET_VMA_ANON_NAME[1] and setxattr[2][3][4] respectively). Since both are designed for contents coming from userspace, it allows for userspace-controlled allocation sizes. Use a dedicated set of kmalloc buckets so these allocations do not share caches with the global kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in active use: # grep ^memdup /proc/slabinfo memdup_user-8k 4 4 8192 4 8 : ... memdup_user-4k 8 8 4096 8 8 : ... memdup_user-2k 16 16 2048 16 8 : ... memdup_user-1k 0 0 1024 16 4 : ... memdup_user-512 0 0 512 16 2 : ... memdup_user-256 0 0 256 16 1 : ... memdup_user-128 0 0 128 32 1 : ... memdup_user-64 256 256 64 64 1 : ... memdup_user-32 512 512 32 128 1 : ... memdup_user-16 1024 1024 16 256 1 : ... memdup_user-8 2048 2048 8 512 1 : ... memdup_user-192 0 0 192 21 1 : ... memdup_user-96 168 168 96 42 1 : ... Link: https://starlabs.sg/blog/2023/07-prctl-anon_vma_name-an-amusing-heap-spray/ [1] Link: https://duasynt.com/blog/linux-kernel-heap-spray [2] Link: https://etenal.me/archives/1336 [3] Link: https://github.com/a13xp0p0v/kernel-hack-drill/blob/master/drill_exploit_uaf.c [4] Signed-off-by: Kees Cook --- mm/util.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/util.c b/mm/util.c index 28c5356b9f1c..6f0fcc5f4243 100644 --- a/mm/util.c +++ b/mm/util.c @@ -198,6 +198,16 @@ char *kmemdup_nul(const char *s, size_t len, gfp_t gfp) } EXPORT_SYMBOL(kmemdup_nul); +static kmem_buckets *user_buckets __ro_after_init; + +static int __init init_user_buckets(void) +{ + user_buckets = kmem_buckets_create("memdup_user", 0, 0, 0, INT_MAX, NULL); + + return 0; +} +subsys_initcall(init_user_buckets); + /** * memdup_user - duplicate memory region from user space * @@ -211,7 +221,7 @@ void *memdup_user(const void __user *src, size_t len) { void *p; - p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN); + p = kmem_buckets_alloc_track_caller(user_buckets, len, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM); @@ -237,7 +247,7 @@ void *vmemdup_user(const void __user *src, size_t len) { void *p; - p = kvmalloc(len, GFP_USER); + p = kmem_buckets_valloc(user_buckets, len, GFP_USER); if (!p) return ERR_PTR(-ENOMEM);