From patchwork Mon Mar 4 18:49:29 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581008 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A1F6C48BF6 for ; Mon, 4 Mar 2024 18:49:42 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AD33C6B0085; Mon, 4 Mar 2024 13:49:40 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A3FCA6B0092; Mon, 4 Mar 2024 13:49:40 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7C7586B008C; Mon, 4 Mar 2024 13:49:40 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 658426B0085 for ; Mon, 4 Mar 2024 13:49:40 -0500 (EST) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 3AEA31C0D5F for ; Mon, 4 Mar 2024 18:49:40 +0000 (UTC) X-FDA: 81860245320.04.907ACA5 Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) by imf28.hostedemail.com (Postfix) with ESMTP id 69D71C001A for ; Mon, 4 Mar 2024 18:49:37 +0000 (UTC) Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=JEJVApmK; spf=pass (imf28.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.182 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709578177; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=cMb+PmcOht+K9M0r7eBe/cOsz5NTpNrdAZ0O4xFPS4c=; b=6/65nHIoFy55DOI3Y8VX9gNfMMXd7qyDZww+VH6Fr1MeONyw7yRdCU6ILZ9TwtLcbAk9R5 bckhjyS1RrRhMMsyh3iwgF6Bs2z7+XoJTYUgYrMXItYF9jhVL7FyBJRlIoe+IXJDwiU3Nx /dHI+B1ObwT0vhQW+E926g9kw9tupiU= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709578177; a=rsa-sha256; cv=none; b=KMD1Ix9AOQgbshAzLb1aeUEqxJcYwUhC2V91z5IGg/52vBKTwFF+KDDyV3lRjzFbG8jn2N cVEaEcUubFEfey+1lRn+pNQ3hcinHt8kmWXryYRr2NsoEhCUIVMtEwD0Xe5XEQlrlzJuSx IS0XQMRjf+VoQq5iPcRAbQZs9RDzrXk= ARC-Authentication-Results: i=1; imf28.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=JEJVApmK; spf=pass (imf28.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.182 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-5dc949f998fso3766145a12.3 for ; Mon, 04 Mar 2024 10:49:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578176; x=1710182976; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cMb+PmcOht+K9M0r7eBe/cOsz5NTpNrdAZ0O4xFPS4c=; b=JEJVApmKZPGvpp1TPsV2rvRkatsJazqcfBr8s8Kp6JJhCQZEZzWYF1ZkKNZzLCzTyq wNmLcih+Bw6sk4b90b9CgjXW++OSH3p3AhdwGqovC2u75953QI+s2jJIGRhp0tL28V9T AKbKx3KTmrxgnYnvx/bK59f8TZOwYkYdZfXzU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578176; x=1710182976; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cMb+PmcOht+K9M0r7eBe/cOsz5NTpNrdAZ0O4xFPS4c=; b=VYfrMleYm6e/EYuARTUEVu+1BrVz2h14qd6Rg7IuFy6ygmank9qhpb2ohqkllfnoN3 1PKutfWGdigKqTJY4hiCKpafLG1aNGF1Dr165EY/EC9YGegx8SZK9aBmHoAYdOsQNGwE Z9q7L7cUG4L4UiC437K75S4nT5uF9kKnZxGTqK8sIQfezzIi8nUXTw8b4JpvS47QAOhC iaz7ihPAnrtaffzoGOnDcyXZOSxgLqFx21YAyN5BstXstu8W4/5Pb8WW2U0fwvJoZN8V gxQL2n1BsGfdLN3hZA40+JESbQKG2sk7p+mlmQrEQ7dKul+yz1hjpQbCZ19vD6hn81cS 6UVQ== X-Forwarded-Encrypted: i=1; AJvYcCWczyWiy9QIFibO8A8aiqQX5ZjGu2CofanW0YtSal0wX2jsl7ySEVTxoYmCN2GR3810vYINLLbKdnewomBtBmzr6a0= X-Gm-Message-State: AOJu0YxRxHBMhsolqg2p7k+5KVswPbZ+ssMq/kd3NPsSY8DKsTf4JUf8 9lNQbpA9bjb2dacDyBfDX/k2NqvXXIaWOZC5Pov71IICHJJPnjYoexWY5tsVoQ== X-Google-Smtp-Source: AGHT+IHXfzDDi+Jk/MGWJiolbgqaEdJ79sjoSCtqB+82MCn/uMPrW4nNSDO9Xzsngfqy/Yg749crOw== X-Received: by 2002:a05:6a20:a11a:b0:1a1:4a21:1fe3 with SMTP id q26-20020a056a20a11a00b001a14a211fe3mr1759584pzk.0.1709578176143; Mon, 04 Mar 2024 10:49:36 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id z12-20020aa785cc000000b006e56e5c09absm7810419pfn.14.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, linux-mm@kvack.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Christian Brauner , Al Viro , Jan Kara , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 1/4] slab: Introduce dedicated bucket allocator Date: Mon, 4 Mar 2024 10:49:29 -0800 Message-Id: <20240304184933.3672759-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5798; i=keescook@chromium.org; h=from:subject; bh=h85WkZi4o3uylzu/3xQb8d5MHb8DhVgIptaT/36yfQM=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8a2IWxCB3p2pd4ASVvCAfbFqAl2DgpfxWQ QjMAXgEaQyJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A Ju0qD/9wLY1KtAVlKpiIcbRaHdOPbTRV4/D+hFxL5B9cNYkqbIS1fUdUJI71wBUD6kJnhCd9kCz zY7AbWXcvcgkl2cA36q3sg5ftbAUAugShF8SRrO7cuJBDBjz61Sd3q8a2ajePTuRLXO+IkiOZSW fEs0uw7D3bTOvVIQAaqxYIRhm5g0wDeFJcikNAE06pyX++iA/ePzCLUTui8hhrErnor+Eok1Gio km/LhI+jGhbmoV8EFNFn5yCij/hBhmf/m80ThCIvRs4Lrfs+Jc6NOeSHI0vjyiNxh2dY+XB5kpD yrScvBaBU8MD0PtoCFyo3sqIlhB8epaO9WymgCqRuF+mYuac6RjWgjZh2wBApo+SwpQFUb8g2fH as59RRHY0OQj+s75GtR8Ra9PHvO03ZpOGrKZj/tZqCkbIt92ysyof2t2O2n5yBLKAnTWrUAbw5g SUF7DF0cRG3BfxkZknrhUe6vrhx7uHHB3EHgs3aqEPbc15a38JptIoGR6vga6dtfq38DvPQguDC 2FQBjQRAQbIhYnATKR31hLJTYiwQ2n+HwHoOW0NawX/LV5lAFUf/Z6+hHodr5UK8PFA6Nd+44eM BnNhe+/usfeJyldh8jlzjBfT3UJIcUYGR+sfEjSE48hTeze4iwwNvv/OMOHmv417pCMNY8ohvDd m7Otqn2ryvvKzHg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Queue-Id: 69D71C001A X-Rspam-User: X-Stat-Signature: ifguo5ptxh6fz4mcegqtekdikmxg7kb8 X-Rspamd-Server: rspam03 X-HE-Tag: 1709578177-719155 X-HE-Meta: U2FsdGVkX19qG88lSPLYUtGQ++RWpVw1bfjX5cgWrCfGdi0e8NTIn7CFGK3WEpQf27ufY1czNVyXbh2mbTMIoKhkgucwbqH3lPpO+ZbKcmllme3gsqWDfBb5AcyAI/tJ84E+KUuhwxKrfyz+dzDaGjP4LVilUzgeOki/My6aI6Y9YPnw/gERUSVjSOzdvD2CLXHeVPt5NPjTmi3gB3hKnaCAyvDTPQJQFBYLayxrb5d6bXGFILn0tAFsX8sIw6Rxe5VcLv+Z8uBOJBiDNh674Nos84Ct/rd9X8p1BYGeAcWcMwBSzBZ+EwqdoeQ54Ue+QBuie6GvNnkKYh5H6H05YzYwVR6vh7IzQ8bsbgy1czaGUSaT4eLhjPZ9nOw/YQhd2msXk9iR4W0+LYC1RCfEIMUgFE9owYLjh6mS9u9c6JClz9dV301mdPSz833Xd7DGHLJrsqNaLle/cYxx8ldjdCarRpy0M+59tEZd1ulNEKADkp1XzYQS2wqnJlHJ/Bkss3x9pzUFqBq29qcWC/GsD0QfXinZr+Xp9pkcQ5vcCALSwrfBr2hwKvoIbQs1RC0Trqe4ODthbo13OXmoOoOV/9bzRsTatp1eP7xUtwFY4VeD6RI8o+i/tgTc74MHfYJOFSi3d0Tnvp6wQKC10VFQ3qh20bJyXIci6/AiaLPa+xIkLWW/0pyvITLr/L/xiFEganTykei65c3eXrECnJ+ucTXyy1QpC1a4+rRvZXeZ3o8wHcy2yQmZR2tAJOFlkbF0vB5T770rtsDhJXEGal+nKeD6DKwVUzVZIkIs4095tybCtx0SFf5F3Tbvrwl78NwOzmEmexBvf22lSdSMynUP3MUeUJpZvgXa1E6BgbwvvOpRCdWDTv8fb6hty2RjlozZpAW+KBoUOsSbhYPQmFkdrrCIGJZDNq8BxHX/U/dnSw9A5fGviVHOoK4M8Gqto1o2xy9AcFddLXZ+5sToWbG XDSLCnvJ R/RaCURJAfuYnWINMCEk/As5DeU3XC3MjQAgeK+cMKgwPcFYT4ZPqO1JMYfTbu+Nd8flD5z+lU6Eb77YyQJQ3YGeFsp0wv0/3O93bes/R3StbmI8PlPduvgFCb01b/EqU+W7HbnXsjMn84/TwUIcYX6rH0u0KY42kFrOH8KiGMTFnwQ7ikEiWcjfa+VsrnbEK2OJL X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Dedicated caches are available For fixed size allocations via kmem_cache_alloc(), but for dynamically sized allocations there is only the global kmalloc API's set of buckets available. This means it isn't possible to separate specific sets of dynamically sized allocations into a separate collection of caches. This leads to a use-after-free exploitation weakness in the Linux kernel since many heap memory spraying/grooming attacks depend on using userspace-controllable dynamically sized allocations to collide with fixed size allocations that end up in same cache. While CONFIG_RANDOM_KMALLOC_CACHES provides a probabilistic defense against these kinds of "type confusion" attacks, including for fixed same-size heap objects, we can create a complementary deterministic defense for dynamically sized allocations. In order to isolate user-controllable sized allocations from system allocations, introduce kmem_buckets_create() and kmem_buckets_alloc(), which behave like kmem_cache_create() and like kmem_cache_alloc() for confining allocations to a dedicated set of sized caches (which have the same layout as the kmalloc caches). This can also be used in the future once codetag allocation annotations exist to implement per-caller allocation cache isolation[1] even for dynamic allocations. Link: https://lore.kernel.org/lkml/202402211449.401382D2AF@keescook [1] Signed-off-by: Kees Cook --- Cc: Vlastimil Babka Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Andrew Morton Cc: Roman Gushchin Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: linux-mm@kvack.org --- include/linux/slab.h | 26 ++++++++++++++++++ mm/slab_common.c | 64 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+) diff --git a/include/linux/slab.h b/include/linux/slab.h index b5f5ee8308d0..4a4ff84534be 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -492,6 +492,16 @@ void *kmem_cache_alloc_lru(struct kmem_cache *s, struct list_lru *lru, gfp_t gfpflags) __assume_slab_alignment __malloc; void kmem_cache_free(struct kmem_cache *s, void *objp); +struct kmem_buckets { + struct kmem_cache *caches[ARRAY_SIZE(kmalloc_caches[KMALLOC_NORMAL])]; +}; + +struct kmem_buckets * +kmem_buckets_create(const char *name, unsigned int align, slab_flags_t flags, + unsigned int useroffset, unsigned int usersize, + void (*ctor)(void *)); + + /* * Bulk allocation and freeing operations. These are accelerated in an * allocator specific way to avoid taking locks repeatedly or building @@ -594,6 +604,22 @@ static __always_inline __alloc_size(1) void *kmalloc(size_t size, gfp_t flags) return __kmalloc(size, flags); } +static __always_inline __alloc_size(2) +void *kmem_buckets_alloc(struct kmem_buckets *b, size_t size, gfp_t flags) +{ + unsigned int index; + + if (size > KMALLOC_MAX_CACHE_SIZE) + return kmalloc_large(size, flags); + if (WARN_ON_ONCE(!b)) + return NULL; + index = kmalloc_index(size); + if (WARN_ONCE(!b->caches[index], + "missing cache for size %zu (index %d)\n", size, index)) + return kmalloc(size, flags); + return kmalloc_trace(b->caches[index], flags, size); +} + static __always_inline __alloc_size(1) void *kmalloc_node(size_t size, gfp_t flags, int node) { if (__builtin_constant_p(size) && size) { diff --git a/mm/slab_common.c b/mm/slab_common.c index 238293b1dbe1..6002a182d014 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -392,6 +392,66 @@ kmem_cache_create(const char *name, unsigned int size, unsigned int align, } EXPORT_SYMBOL(kmem_cache_create); +static struct kmem_cache *kmem_buckets_cache __ro_after_init; + +struct kmem_buckets * +kmem_buckets_create(const char *name, unsigned int align, + slab_flags_t flags, + unsigned int useroffset, unsigned int usersize, + void (*ctor)(void *)) +{ + struct kmem_buckets *b; + int idx; + + if (WARN_ON(!kmem_buckets_cache)) + return NULL; + + b = kmem_cache_alloc(kmem_buckets_cache, GFP_KERNEL|__GFP_ZERO); + if (WARN_ON(!b)) + return NULL; + + for (idx = 0; idx < ARRAY_SIZE(kmalloc_caches[KMALLOC_NORMAL]); idx++) { + char *short_size, *cache_name; + unsigned int size; + + if (!kmalloc_caches[KMALLOC_NORMAL][idx]) + continue; + + size = kmalloc_caches[KMALLOC_NORMAL][idx]->object_size; + if (!size) + continue; + + short_size = strchr(kmalloc_caches[KMALLOC_NORMAL][idx]->name, '-'); + if (WARN_ON(!short_size)) + goto fail; + + cache_name = kasprintf(GFP_KERNEL, "%s-%s", name, short_size + 1); + if (WARN_ON(!cache_name)) + goto fail; + + b->caches[idx] = kmem_cache_create_usercopy(cache_name, size, + align, flags, useroffset, + min(size - useroffset, usersize), ctor); + kfree(cache_name); + if (WARN_ON(!b->caches[idx])) + goto fail; + } + + return b; + +fail: + for (idx = 0; idx < ARRAY_SIZE(kmalloc_caches[KMALLOC_NORMAL]); idx++) { + if (b->caches[idx]) { + kfree(b->caches[idx]->name); + kmem_cache_destroy(b->caches[idx]); + } + } + kfree(b); + + return NULL; +} +EXPORT_SYMBOL(kmem_buckets_create); + #ifdef SLAB_SUPPORTS_SYSFS /* * For a given kmem_cache, kmem_cache_destroy() should only be called @@ -934,6 +994,10 @@ void __init create_kmalloc_caches(slab_flags_t flags) /* Kmalloc array is now usable */ slab_state = UP; + + kmem_buckets_cache = kmem_cache_create("kmalloc_buckets", + sizeof(struct kmem_buckets) * ARRAY_SIZE(kmalloc_info), + 0, 0, NULL); } /** From patchwork Mon Mar 4 18:49:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581009 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B96AC5478C for ; Mon, 4 Mar 2024 18:49:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DE6136B0089; Mon, 4 Mar 2024 13:49:40 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id D950B6B008A; Mon, 4 Mar 2024 13:49:40 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BD07A6B008C; Mon, 4 Mar 2024 13:49:40 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id A02396B008A for ; Mon, 4 Mar 2024 13:49:40 -0500 (EST) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 71A8540116 for ; Mon, 4 Mar 2024 18:49:40 +0000 (UTC) X-FDA: 81860245320.04.CD63ED5 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) by imf12.hostedemail.com (Postfix) with ESMTP id AE72140008 for ; Mon, 4 Mar 2024 18:49:37 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=e8qnrbgT; spf=pass (imf12.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.174 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709578177; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=63pQSv4lgdcPPxgjmIdkeCTgPw+ykuMnj3qldPskCm4=; b=ceG+VHe2pcMuUXFoQEoeMCVnLwX2q+kAlMqiBng0hDFgNaiAliVJMZwoIzpLJjc0yhr3wc 7YgB5wxEWcNinCPfLWXvGVxhQVsGPzxhJ/Fgc5iz+Y7wQKak7AKFiAy+cIbclqm3HPpK8D pwYzxujM8aRpkMo62aKpZPObybr8mtk= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709578177; a=rsa-sha256; cv=none; b=LKHsnOq2jAD9uoIlPNkbMyOTXPR3nm6fAHeK8RPdmbKCCTBEy+54M4ZpDsSCuZZhFtI9EG NDwCWtaTdadsBmwjNOQamw4oyyek+5ignM2aOHeHbtLILLmlujiW0NNMtrTPtgcw4hZPtg RC/qDIrlZIaRIfz6LFcHnQHJBAs8LVk= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=e8qnrbgT; spf=pass (imf12.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.174 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-53fa455cd94so4186819a12.2 for ; Mon, 04 Mar 2024 10:49:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578176; x=1710182976; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=63pQSv4lgdcPPxgjmIdkeCTgPw+ykuMnj3qldPskCm4=; b=e8qnrbgT0A4aSpJ5t4QU9kEquQKLaMkCE53tX4r8kgm9HLUw2ArD7nNs43SiLTUT1L NqjrNkyPpWluauXXwonRQouWU4vQIEENPIpU6UHVzJl/mDHCoKIfkQUlUDmsqndo2Qdv ePbus3J+fl7kJoXzdAsKiJn2vPlY1eTv3iAcU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578176; x=1710182976; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=63pQSv4lgdcPPxgjmIdkeCTgPw+ykuMnj3qldPskCm4=; b=OCWKn5hpJzHZvXyP4VIOmlegMwQ83t6v4TAuZJMHy5K2j7bWoGNM+ass1qBJu3pA8o mtnCzKG0ayf59fQ44jbHokMniYbu0/ee9WKnJK5eR1GeiM1DV3lo2ff/C4TvyYwA2xwX RTdHMp/b0XmRFAL8yJWP1HzV8ekTIjhXAYCxx07e1YjsD9desjtrxQndTQ6byNZ/tUf9 G3saaGyELO17AzIjKQs3LvEKVETFDyrCMhhWjAm9jUEdLrbqUAM7NSMwrjHj5uQyIcl4 8TQ7VLUVpgrc39RUBGUsYSeRWl2QB3VrYXD5HYtWj+BhCanDUiSKID1OsFsvZpB51Z8t eeiQ== X-Forwarded-Encrypted: i=1; AJvYcCW4w0HAqs8yvipCkOTn7LZMhWT1vkd+vQGcIW7Ep53taFR4wguqMe7Aa6Qdtb9A78V9Uj+MtDkHGkaVNr04brhRtK8= X-Gm-Message-State: AOJu0Yyiyw3xbT1gdzQWAQVKsO9q62Y/f4jIM26CNLQ8mPkOAg/jX8Vt LOqYVKaBtunTi8VnuC5rU5DpPFdg+4ScCkmXc+4yfXHcSarO1nEQstZBFK3lgA== X-Google-Smtp-Source: AGHT+IEqbrBUCeaoycN6eZ+VoJQJ/3ekxM3Ni9GrmrAmVAhx541ISPKoahwiO20Sd0vgoGv+eX/7cQ== X-Received: by 2002:a05:6a21:9214:b0:1a1:4842:6760 with SMTP id tl20-20020a056a21921400b001a148426760mr1903106pzb.50.1709578176499; Mon, 04 Mar 2024 10:49:36 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id j4-20020a654284000000b005d8be4c125csm6743414pgp.80.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Christian Brauner , Al Viro , Jan Kara , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 2/4] ipc, msg: Use dedicated slab buckets for alloc_msg() Date: Mon, 4 Mar 2024 10:49:30 -0800 Message-Id: <20240304184933.3672759-2-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2289; i=keescook@chromium.org; h=from:subject; bh=+zltM60WJIwhQhbYbj+QC0RcHFfEEaTaC5b3PkagfmU=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8qRUAcVCqu4hpjGv4CjmdHzSAnbUNg4er3 NYamCewr9+JAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A JuDzEACBBwraGVldgENLbkSYf63dOOHOPJEiqhaSkAxMKXMPigi7yQdQbfcNSnwgtebo1L2uUYv 8a5GjWZgg0pW2K8BJCfxaWqaOKGcKcaQl1JGzOhYIznQhTvy3eFL7liqoKr/iyqINgJllEJw5u1 73nGpA9SrpjgMVQ1WWjUKo3CDRewIUR0dTk28fcGEgg2RubRBocB+ojMwSQvPfl2WwXNNJ6NnaM t1jPN5TOfmjkQwM+IKkwdXSau+eNTMhtba3hE02RRu1OPtszIgPzv9e6R7LQqcPA+z5Nnw9Mx4y ZbqEuw8j6jqARnWfEt9pH8SBkxg5A5JD8uhSVvD9eLQTvHQ47gbqoIV3OvqhNEVQB2mMxiFpJIK NlLkEb/nSKSv3ezcvBEPp9sNggeP6uknRz72aj7v0lLBeL9dnwoPjQS8Vx4tIco3WJcVgCiOxes 11aqWUfxoQSK/Hm/2uAQSZRBPq9t11u4mLp4PCdwiyhfBdIqhHXQUXwKfqAd5M95kCOWSger5J9 de8D2cgNhvOQlrVe+1Oj+J515SQVuJJH4p1jmyS5NEs9nXqR8qExyhvPhjm7ka/HrKG77o3MS0F 7hijfdr4qYUQTGuK0lTaECipjA3875yLPsHC4EB0tB+xynBLCgMVx7JT6jFuddPDRtCkf8QdmaT L+aT5CFzJLRrfWA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Queue-Id: AE72140008 X-Rspam-User: X-Stat-Signature: iwthopodnmfo6yeigidq1puyyfrw9mxu X-Rspamd-Server: rspam03 X-HE-Tag: 1709578177-668044 X-HE-Meta: U2FsdGVkX1+TwzjdHgef2kOcfKACksYFv9/cKn0gH27z6CENgJDfttk2MwhNKL94IP4xtxLrHFJ/Tgs8uF9vvuo2ZTotxBEAevasxuFp/9kK4BBhyQSgfG1VmgLzmNoykfftAqLyzUysxpozl5iMd2KJMXprnkX07nP0W+OZ/sHTuBNjRO+egnXX4awKQeyoA19PK9dXveLeCt0ba47E62PKdS5WcbsS/LqVW4f5/XGQHhyEgB2kec7Hmc3lH7BApu0zY5Gy8kj3ZYaYhLN4HjAwY9h8azmvGvpM5XXsqr4zqxpFMB80DfzUsz3qVwY+iYkbtXojQ3eg8Jc9c3zPPAynWcEef2BdY2XlXpfldB95tSqYN5F4Hpmnav0Kk90L50g8PaAvQtXsoAgZ6Dxa4BdGUJbF0/WK2b8CSs4znHG6O6ALbvXbQU2PFeiIwSQtDN4A0CnO60V5DwAMbsmH6rWJRnjwkCvCxnNMdwn4OGzHouKJijdR28ZZEzxnlHgL22LOKHoQ6qerocoGRfl+plcxzV0G1w+torNt9dDnU7YjhM8prNpXxlL8QputMHH8Pm1TYTJ5hTXSUvkajS1fF3L3hs5YAvmaBUSjZGsdrnDWqSM3wrJPbt/DMwU1sw2w9JBAMp2/G3B4DIyh+qM5f/thpIRTEgv3aOZlpOe9sehnkjgyXKhE5kRskWLzLhLF0hqkXwVzwnx7AJtd05yHi+qwApWaMMRNQGgNUql80U1trlkEnUvW8XW9KC+GEozKVXBx5hbydYzmbkw3sM/QZSJ4zUwIqgvg2xA2RoP0M1M+Pv5T4OxGm23R1xnE6myHsjc+wkfxKRh39kI9Mu5u3ucdgNAdfsa6MTrKHdqzzPtgR4tdOSbAn7dnciV0ljcpolq1GoefT9P0315Xnb6rGzLDlYsXY7RDkSDT+pcCu41DJLHpjw7+BwxHXs12TwACs6p6o1ERutHa+RvRVIu HXRbe1W4 qy11veHcTnZjKc1G9SZpIv/Ea2mbO7jU04lFft6+uX5O4KQ3T2dcxhmt/467j3gtGakZUB3OTkclIMZfv55LTDmqCZkztw+2ug+w7umiGdyZTXFIN3VNdLQleZY3hBtcu3Hy981r2nuz4yZ2xJitEZpssj9pzWaQs5WR+zuYDqdqkBa4RngFfMYDnD93xrFjQS0vqt4hjyNMWF8/gqHYLN6a0d1eurxh8VNdw1cKBIXPQZMOM/8Zum1bthA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The msg subsystem is a common target for exploiting[1][2][3][4][5][6] use-after-free type confusion flaws in the kernel for both read and write primitives. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in use: # grep ^msg_msg /proc/slabinfo msg_msg-8k 0 0 8192 4 8 : ... msg_msg-4k 96 128 4096 8 8 : ... msg_msg-2k 64 64 2048 16 8 : ... msg_msg-1k 64 64 1024 16 4 : ... msg_msg-16 1024 1024 16 256 1 : ... msg_msg-8 0 0 8 512 1 : ... Link: https://blog.hacktivesecurity.com/index.php/2022/06/13/linux-kernel-exploit-development-1day-case-study/ [1] Link: https://hardenedvault.net/blog/2022-11-13-msg_msg-recon-mitigation-ved/ [2] Link: https://www.willsroot.io/2021/08/corctf-2021-fire-of-salvation-writeup.html [3] Link: https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html [4] Link: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html [5] Link: https://zplin.me/papers/ELOISE.pdf [6] Signed-off-by: Kees Cook --- --- ipc/msgutil.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ipc/msgutil.c b/ipc/msgutil.c index d0a0e877cadd..36f1aa9ea1cf 100644 --- a/ipc/msgutil.c +++ b/ipc/msgutil.c @@ -42,6 +42,15 @@ struct msg_msgseg { #define DATALEN_MSG ((size_t)PAGE_SIZE-sizeof(struct msg_msg)) #define DATALEN_SEG ((size_t)PAGE_SIZE-sizeof(struct msg_msgseg)) +static struct kmem_buckets *msg_buckets __ro_after_init; + +static int __init init_msg_buckets(void) +{ + msg_buckets = kmem_buckets_create("msg_msg", 0, SLAB_ACCOUNT, 0, 0, NULL); + + return 0; +} +subsys_initcall(init_msg_buckets); static struct msg_msg *alloc_msg(size_t len) { @@ -50,7 +59,7 @@ static struct msg_msg *alloc_msg(size_t len) size_t alen; alen = min(len, DATALEN_MSG); - msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL_ACCOUNT); + msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, GFP_KERNEL); if (msg == NULL) return NULL; From patchwork Mon Mar 4 18:49:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581011 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8A5DC48BF6 for ; Mon, 4 Mar 2024 18:49:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EAA306B0092; Mon, 4 Mar 2024 13:49:43 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E599D6B0093; Mon, 4 Mar 2024 13:49:43 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C369A6B0095; Mon, 4 Mar 2024 13:49:43 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id AFEB66B0092 for ; Mon, 4 Mar 2024 13:49:43 -0500 (EST) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 81AEC1C0B04 for ; Mon, 4 Mar 2024 18:49:43 +0000 (UTC) X-FDA: 81860245446.07.D67BE7B Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) by imf01.hostedemail.com (Postfix) with ESMTP id B16D04000F for ; Mon, 4 Mar 2024 18:49:40 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lPvN3MSQ; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf01.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.181 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709578180; a=rsa-sha256; cv=none; b=PiuQEKmHs+M5LZ9Dp4kXw5rttq/sc3AegYWvaqg2O2SDQgUbziawMyrlMkALroiNk0A4J1 jI19ciGkMVR9u9kIaKaW8DjSyTO7bMSyLfZroT7KwhEz5ogeoNs5LvGxRRRF1QVOD3K2Vx rX0JCeoAgzlgtrsW2vWOVlXLZN1x1oQ= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lPvN3MSQ; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf01.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.181 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709578180; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=awxpusEpwcvQL0W6vZCOnQBW4rjYdtneyXEUJno5voeNJ3r7p4eW7VaEtuXXcq9+aTG8Qy E8gDUw84i7HZQR2xHS+JtKXnBNYoGbURoN01pBrJB9SdH5vGlktXu37Blxxl6kuakTgua/ 2sQlACkvU60e/zz9vRIXMF+peRqO6Sg= Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-6e5eb3dd2f8so1489572b3a.2 for ; Mon, 04 Mar 2024 10:49:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578179; x=1710182979; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=lPvN3MSQRlwEboq8pcMui/R54O5+i+pEJ8AUs43sVswveem4ROp4PsogpzgepNhiWj HrMqOR62YeBbDC1XczTQa35DHiIh59EgvSx06+/PX6uQOpGMHb1UB6B/QatF4UwmlMFC u8ydnFtBEhcm0VYpHa9Qn5HNBK7ur6eycXp+k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578179; x=1710182979; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=gq4sd2NNyQTcO9foWkytR2QsI19+m5PqYv6TuTsR81CkHK0Rd+R+8U3Oi9kwejD/uQ AWmodLhpQ2nTGb8S0gzoJRBYAmq+U6ILmgvTbh95ijYvuk2eSKIM8HYTSW4j8xBfFlcG 5FV1NadcT6sgkfTv04h8RQzvNfNDDUtZFa4amE79lAKRAAzq0Fm8duUmyvLtnAbP6qcl FsnjNAD/N9DUmnWjBDyvegb1a0VOWlLDz+r/R59ViltQOD2PvV6pKjX2fEvor2fbvghT ps/oZl8HxFRW5EHmkJ3DDBrTC0O0jhfS8uGv6WMLDh/rlDw0WYqCnHLjdFZb4SjUs1i8 JRIg== X-Forwarded-Encrypted: i=1; AJvYcCVWvO6SFYUDFXXFoSTvh8A/wZqr5EpBzHH/QMABwFTASiBaHN47LL8slN1waL6Sc7hKrY8W+B5X5eGRhm5Wc5bLcxk= X-Gm-Message-State: AOJu0YxT73RIrFvcRo1N2dMl4wl+/sGDZKkbWWrM3vF+di5oGfP367BS M+xu3XC9JTYCtaKBnpJN65WUGED3kyQtiEniGHX3opJHKlXiVPFl8s286pUQMg== X-Google-Smtp-Source: AGHT+IGILIudDoOhkhQCWTyG9z0DMQjNf1OD2uCgU2558fLWKJP3m4244pk1XqBrh1eKa3auyU02eA== X-Received: by 2002:aa7:88c1:0:b0:6e5:5425:d914 with SMTP id k1-20020aa788c1000000b006e55425d914mr10540158pff.2.1709578179470; Mon, 04 Mar 2024 10:49:39 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id r27-20020aa79edb000000b006e60c08cbcasm2881132pfq.50.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , Christian Brauner , Alexander Viro , Jan Kara , linux-fsdevel@vger.kernel.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH 3/4] xattr: Use dedicated slab buckets for setxattr() Date: Mon, 4 Mar 2024 10:49:31 -0800 Message-Id: <20240304184933.3672759-3-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1560; i=keescook@chromium.org; h=from:subject; bh=IcLElAry6DIoRKKwJQmpd7ju+FKDVUugrCBgj64Jc1w=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8RUV3Nml6+beLYoX/gI6MaxpEQEieiV1Pk LAMHZWkh1eJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A JgarD/9HvGby2B7eoqRlayCbyDlLBOSIiVV2Bq+vUUsC8Ne0FV1zyqgFRQrXbQ2G6VGoWXimSlm M1jvsW/Y99i2kQDWqeDEZeZf+LehlADDm5Vd8pmJfMMgX19BF898FQYPT7s7OKOxOJ4T/GuE1Kf f8BRgEGLrWxyrMYUyG5/wFYfmfEzazDwiU+A/d2eMxhnYFT6e1elFQ0FweaUabd1+ZCJwV5UdWh HIyGFxL/YTavdVnf68HYBNALeF2lzUERVyzafZOv6WzhMzem7sDreYdkBpWwU4Nvafa5vCB+mCZ kz+tSe+uPkTDLUvM18O8w9hPQ0ywaf1CFBDkCciseVfUKVnH06WlWb84AbCwLv1KSDl6ipWRLxU 84NhknBpAY4fgIguhU0kDs83NhdIl/kn10T/oubIkmY5wdavroHRaFjSlkw/VAeVdJCOOH+U3b9 AJDGgUmwEUlmq7b731/mixhLBrz0CTKq8Aa59nDba3ji+Utrd7I1HKHwMPTcsPrBIVtK2QspH+t pcBzTrTkEuaW7vRD41WXoqxhSJ+mUK3+SKCFafsj0ZaMq2qMA977BazfKFPlNrWRRWzRrteGmk1 Q8c9m2anBqS3EOtpP7bZ2OHyh5VlDQiLJP6Mo78p0Tkgsf+LU7XH1gWUSibuhbnTREFTie5DhAK x63js6NDKJKKoCA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: B16D04000F X-Stat-Signature: t8mind47nbf473qqs1aysxuey3xxkrho X-HE-Tag: 1709578180-795078 X-HE-Meta: U2FsdGVkX1+bgEzNfJdTONhKcGY5En9P0HsKL431zQ/aDqQsq1cOGspKklOxnKcTz4TUdLxcspRlGm+XuRYWCtFK9T44AMr2CHJRTZa03MnYtLrKBkUqA03lLu7YqoNyzYmgk+NFIZQTVaSPAw625lAyFrsx+pY3OJLeDgmG9DsRIR+SHVUM7tHmUcCr/O4JJjll37iMObjL9Rbl8C9c6pAqqQ533R1D4/XLXhPZbckZqIyV6Mihf7dw4RE2lbGJSnvYmCR6F7DDcpxhOxgRYD8/ydv+PzEOBfA8n1MfL06JAWWV3TQtSsfUpvCsHqoI40Z8jj8mDrxeE/MtD3mPOe9qLfSgecxKN2aCouKvZTuyHSe/lYn0g4b/aW8eWdpnzh74/zmezE5CLHY+ut5cyWKysp450b/Piz/MXBKHcidpfNTSaPrBQl+y2vsQ6V7muj9gpZg5+sgOuxmwS8lgzshu3eX1vNrxep5qaKjeQWZx7lcGAYlMrnzwa3ucrOhFpjeTRtLNFZTzFMByycMkwds0VKB+rTiKKOKNF9peaH4Qoytb1GV4rrjVoMWM2lnWhr+9cVsVfNLmGNaXZb1frP+apXILlsSxBc07/rLde6NDXvuddAuwge33ZO6xbdWXJEYVWoT+MqEtDkRyqrH6RNPLk2rH04+xOAeqCpBZ1AHRb9WDYI+e17XjfoPjywax9CV79k9fU2XfqrxF5XNRECFT1u3osY5kHDEGDBI6mlVCRB65VjVGiHKZCSN55GsNB3a4tmSA7lNKS6W05GoTPE2o9FuQsd3WUGyweel5NUTkuWkPxZoUYrP01POyj8LcdkU07/B++8uIlHnlsjD0lYVyud+zfl5cVRWWd/yr0/NJ72mf1Crhkbd4avTcHuNQ98D7MtR+4b/TnoKsnUSTOx6qof/ZwIV2A3Z22LqusEps4ESMND6P4g/ne7XgpPJqe9irLGJrCwg9mYUSVIY TQjt3Y/i ifJt4DV4SMnQwsgqE9FPyPepet6keKQZ1exqlh1fxZtf5Uoo6kntLB+M2Nf71+joyy8iFN0HwE6+KmOhOHl/rBshOczG0CpRxrvCjbWcHokjxhCZ8nVRO64YVLXGmDgxJma/Zl2o2U6rRNsFFUJki91DdVZYmT/5TWjZa6YhTT8isDyKJMzeTuknDk/dOf8B+KOzh X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The setxattr() API can be used for exploiting[1][2][3] use-after-free type confusion flaws in the kernel. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. Link: https://duasynt.com/blog/linux-kernel-heap-spray [1] Link: https://etenal.me/archives/1336 [2] Link: https://github.com/a13xp0p0v/kernel-hack-drill/blob/master/drill_exploit_uaf.c [3] Signed-off-by: Kees Cook --- Cc: Christian Brauner Cc: Alexander Viro Cc: Jan Kara Cc: linux-fsdevel@vger.kernel.org --- fs/xattr.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/xattr.c b/fs/xattr.c index 09d927603433..2b06316f1d1f 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -821,6 +821,16 @@ SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, return error; } +static struct kmem_buckets *xattr_buckets; +static int __init init_xattr_buckets(void) +{ + xattr_buckets = kmem_buckets_create("xattr", 0, 0, 0, + XATTR_LIST_MAX, NULL); + + return 0; +} +subsys_initcall(init_xattr_buckets); + /* * Extended attribute LIST operations */ @@ -833,7 +843,7 @@ listxattr(struct dentry *d, char __user *list, size_t size) if (size) { if (size > XATTR_LIST_MAX) size = XATTR_LIST_MAX; - klist = kvmalloc(size, GFP_KERNEL); + klist = kmem_buckets_alloc(xattr_buckets, size, GFP_KERNEL); if (!klist) return -ENOMEM; } From patchwork Mon Mar 4 18:49:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581010 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55D0EC54E49 for ; Mon, 4 Mar 2024 18:49:46 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4E5296B008A; Mon, 4 Mar 2024 13:49:41 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 4950B6B008C; Mon, 4 Mar 2024 13:49:41 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 30DE66B0092; Mon, 4 Mar 2024 13:49:41 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 1E6F86B008A for ; Mon, 4 Mar 2024 13:49:41 -0500 (EST) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 004FDA1126 for ; Mon, 4 Mar 2024 18:49:40 +0000 (UTC) X-FDA: 81860245320.26.A7E30B9 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) by imf19.hostedemail.com (Postfix) with ESMTP id 402A91A001B for ; Mon, 4 Mar 2024 18:49:39 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=d0cJ+FET; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf19.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.179 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709578179; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=3eg+OHwarPCDDbCJMvwZ5D9ntaRfgGqvBfyy5rCCcVU=; b=A20Y8xhpUN+8Lf1O3gBRp97/xRvu6dNbx7l0+1gY9ZSGaGTfLUM/MlYcRklm5Sf6c9JosP pic8Z2q5JZtXh0zy26W7jplm2T5s2xusY+jCwowwIUDCWw4+Lyk7urO+UnTbLQeZDjUSU5 XE4ngPBA3t0z65mfF3C1Z0Oj3WbmxBQ= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=d0cJ+FET; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf19.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.179 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709578179; a=rsa-sha256; cv=none; b=76/UeF3LMMOfZ7c738OxF7D01mQQM361uoC51f1vmyDlW/utSTm26dpk3cldh7E4gtSCCe YNhb/GD9+KJqdMyWCXy1kDDRY6TZybK1OeO7rhk6C6QDzenJ7CUGNYxXjPTpfj6+9qF0z9 4VtrM9RvSD+LGJgrCFvBamGz+WqhPH8= Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-6e5dddd3b95so1867457b3a.1 for ; Mon, 04 Mar 2024 10:49:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578178; x=1710182978; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=3eg+OHwarPCDDbCJMvwZ5D9ntaRfgGqvBfyy5rCCcVU=; b=d0cJ+FETSp1z8GlrMk2FVEKuBwe+2xxjW8QjIPgvIj6m/aO4AWKts9L/90gObmRJFe hL/gSAyS65V6bauNlqDBE1A4bvaTnTumLIAF9fA036RkiO2gW5jhgI9glQRUkrdGJsg4 2Iq85Szq9f++mu1ONo+yXB+5jnTon0dDISmlA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578178; x=1710182978; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3eg+OHwarPCDDbCJMvwZ5D9ntaRfgGqvBfyy5rCCcVU=; b=UBytNZ74WDLUIudS80bI1kW9wcMqftQuxPDHmdFrN8ZlRnSs1IImWy9WCdb2+onWiS LXLPDfV3QaXjHNJ7EPKl7hAX/xP7FeNAfT+AjoTZZyiL7fjAPzTitkXyMeB9OBhuwBLg wK0UQzP/tyTrqpEyko0ueg+lV0ZgCnfTL+LRh+soh8P5Odr6XptbpragPUhbU2ciWh4J u2MtgU1lZKS+5wqDXsl+gVepMbZgj5WSBdj1lUxotguolYYqjWbfZJCkRRLD3ugpBCoF U+tWUSy4mAuW06XEqcFGUwlljqnLO4RqxnsfbtekyOIg57ksfR9F24SjEv70UDwx2wRB t5tg== X-Forwarded-Encrypted: i=1; AJvYcCU1UWE79YIIoMTDOswpx+qjxmFU0jcTT0iZxsAZgiCqEvCCxetuUspwQ3tsbVHm754lRqQGTscORRDaEIkKaOYvg3c= X-Gm-Message-State: AOJu0Yxz7FodIigmY/DvuJozvtUzkUCS4NigPl31R56OB+oL63N4X3bm kXzxr9Ae0wrqVwMHMfXyFdZu9hKUshsNad71YSvJEKkfpE8hKQyox79JnuwxXg== X-Google-Smtp-Source: AGHT+IGLXRXXimciJBhdk/dIb4Wb2zbKj+H0Uz/ceqDu67vjZT0fdQjMBcnwKVhjTqa97KV6aSVCaA== X-Received: by 2002:a05:6a00:2d1e:b0:6e0:50cb:5f0a with SMTP id fa30-20020a056a002d1e00b006e050cb5f0amr397502pfb.12.1709578177665; Mon, 04 Mar 2024 10:49:37 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id q67-20020a634346000000b005dc49afed53sm7759425pga.55.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , Andrew Morton , linux-mm@kvack.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Christian Brauner , Al Viro , Jan Kara , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 4/4] mm/util: Use dedicated slab buckets for memdup_user() Date: Mon, 4 Mar 2024 10:49:32 -0800 Message-Id: <20240304184933.3672759-4-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2330; i=keescook@chromium.org; h=from:subject; bh=wVlg4Ywlqm3758Z/+rtNyin5k6LCR9PFs+qzYTfk1+I=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8UYVHiwP9jlErQNW8kOwDMEcuQZnM208D3 8K1ECbNwiWJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A Jl+iEACLE6xmcDHNPJUI5v4X0mux03kdgYRX+BLElIYHYI7U0wjiKpXajjtdiBhgakpjXtztCWM P2osPYx1h7voVbtUuUWxNhSonJpnB0Nm+gAimqzvFzjmcT3+iOzWMdkuQIrnE6UmT3zpJFc6XCU g2QFAVxdiGa3N2vDovfT4v30vBd49SiQha0Ku6yG7HjCQGZlzRr99NRAgutT/m9cF15+jsLLygf 27uNjMhYBScQ/t1LffYt6H0XCkJx/H2JYQjJ+BPC2G+PF99sedHnXOHDSkQv8x5Hl4PIhPslxFR 91ZyIfi2gek3k1qy2AtzadMoj202Ge/xe12M85LUqMOsf6P+R5s8/g8DiXl4l7Id7cPOTD5r9BS SNlQ7S2KaIK2wznKMO/HoLjyqgjZhMD7IeID0qZ3TfjZ8BbqOuvRGqLMgn8tzc3LAB8agyecsTT g0+xAUJYNoc8NRwjsjVNz+QckpIFcvn8kiUHKXwiZ2Qmorl1p9Fd9x1CQ9sTiJa59YI8DAUJ7Hb dQsvxWmevu1RLkIB1tmDdAS2pqIFmK+0m57zvWu5UJnhkIQV+kiDxu0Dd/kq0opljR4/anmfMur 7WnTU2xy/QXL6JGYC1RXjxC4niOzOIZjfPwGZsXbo32sj+XkZkGkZ/jNwB4eNjVnoNor7p7CxLD i3hiwyQiWnJh+Xw== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 402A91A001B X-Stat-Signature: jq96takzpma7cfhps5rotab88agmkrn1 X-Rspam-User: X-HE-Tag: 1709578179-678226 X-HE-Meta: U2FsdGVkX18+DTLnPZema72nVrRAP5izAGbtObvMZwGoc+Wo0zAw8skoVe5OvgtgZtAa2sO090g/NmLMIQ8DTnYKt5fk5ths1Sj418YorCb2tqvCvACLetcsOmtqej4Nq0T8tqILLEWCqdbwfgCCB2+4Ycab1/9mmbXJ55NMSMhkmfsWKM6PiLQ6CGnirZ0mPQyneY3XX3hh2XwJ99l8RStN3lqjO3Gkoq4M99lhDNEGHS9lX+G6MkmnIseyLX1C/HFn7Ztzyf0/OZpD1SedvxMSqp/8HjFHCFWLcbfx9d7D3lOZ+C6py8QC56SQgkEEoFdqffl+Vq4QBV5tz9awmJ6+ecI1l8UgKvsnln6XP36PKi+0t4dWM5Ite7xPDbjYwJNzMPzrqGVScn+rLUxE9sksrsx9GXfqauviurPwW0cVsm0V5dxYpyn8xeCpaJnxs1QNAm6YmRa/Fo8OOqd1n+4xITwhvvos6l5vpuiBbSMJ2MCX7TxE+1AhU01nMs6jby5VGRj/AQvs0aDo97/EZGR4gl5pcJbAFCSgRv4zVisLdzPx1bR2JfzvCzUti1P/9dx9vZGGIRNg7Ia6G8IlTmsXgP2ZodI7aC71v1IS0NSn5CIvcANLzt/Xx9ye7LkldyOPSnKCPJw7yx3/F+iR+2BAQXMSlO99lMIKcXcZw5v9UoGNTgD1tlxTOTlcoCaPeet2KMdZPz2Q6bzxS6qK6fke4carLVfQiA8i7AJ37CzmzmVf5W5ks/Mq9Q4IA0h8P95wQZgwopkIJTM06KOwbeJwYCOTDiQMgnOySY0IwqoGOpDCKCFOkO3lOkRCMmVqldzdXbRYPmIWzigtQIbLc7nYd/+4/XpYSYEAlSim6sEY/VcPG62le51flYqtg+4VP0BjwGJ3ppx3CV//b1q3rcktt6c+4uZLG5TEiCDSCCx6gs4Cz1vDfuMhBpgc9wGQ/xsjieM9Hp0cAt0O7OZ jPxeR6KQ 1wdKfoSAzsh8Abiv/ZNbyH2RDNcce07LwvGHINcpX5MmJ2MPj/VXRLv8tqPuf2zFAyOA/mi6RCd2/PXyxkRONxXiZ4wbpz8FueCSKGSALA22gOg6fQEQG81SxaVU/tFRL+HcdlRoaY1HW+LBr+uk7qrM/SIyo2agBa12uNVG7CQFGRcVyLhkK3iTHkLHBf8cCs2p3EGM+r6B+7r4Zy9yJUAG6HQuCJSw6J5zbQbWzb8ylz98= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The prctl() PR_SET_VMA_ANON_NAME command can be used for exploiting[1] use-after-free type confusion flaws in the kernel. This is just one path to memdup_user() which is designed for contents coming from userspace. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in use: # grep ^memdup /proc/slabinfo memdup_user-8k 4 4 8192 4 8 : ... memdup_user-4k 0 0 4096 8 8 : ... memdup_user-2k 16 16 2048 16 8 : ... memdup_user-1k 0 0 1024 16 4 : ... memdup_user-512 0 0 512 16 2 : ... memdup_user-256 0 0 256 16 1 : ... memdup_user-128 0 0 128 32 1 : ... memdup_user-64 256 256 64 64 1 : ... memdup_user-32 512 512 32 128 1 : ... memdup_user-16 1024 1024 16 256 1 : ... memdup_user-8 2048 2048 8 512 1 : ... memdup_user-192 0 0 192 21 1 : ... memdup_user-96 168 168 96 42 1 : ... Link: https://starlabs.sg/blog/2023/07-prctl-anon_vma_name-an-amusing-heap-spray/ [1] Signed-off-by: Kees Cook --- Cc: Andrew Morton Cc: linux-mm@kvack.org --- mm/util.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mm/util.c b/mm/util.c index 5a6a9802583b..818e74d11fb6 100644 --- a/mm/util.c +++ b/mm/util.c @@ -181,6 +181,16 @@ char *kmemdup_nul(const char *s, size_t len, gfp_t gfp) } EXPORT_SYMBOL(kmemdup_nul); +static struct kmem_buckets *user_buckets __ro_after_init; + +static int __init init_user_buckets(void) +{ + user_buckets = kmem_buckets_create("memdup_user", 0, 0, 0, UINT_MAX, NULL); + + return 0; +} +subsys_initcall(init_user_buckets); + /** * memdup_user - duplicate memory region from user space * @@ -194,7 +204,7 @@ void *memdup_user(const void __user *src, size_t len) { void *p; - p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN); + p = kmem_buckets_alloc(user_buckets, len, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM);