From patchwork Mon Mar 4 18:49:29 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581015 Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E51B578690 for ; Mon, 4 Mar 2024 18:49:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578178; cv=none; b=MxEqbeIwim9S+aF2QMu3bDDXQjbO2jfHqIx1d9/fQTXDTKUdayFIwqWTxvHSPKxnl4zy2qxqaKcArCIrk2TGkOiKLznXUTLdF4tx3S3/ksTpxUBSRzEc59lKHM79PLIUbaA4peae12MC/BaWbWHI17GiQ9KrHw+jVgdtJk3QGsI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578178; c=relaxed/simple; bh=h85WkZi4o3uylzu/3xQb8d5MHb8DhVgIptaT/36yfQM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=HSPWRiU9vBwPPtj1Nw3KP1sh9rHQJBhYsStffKV6GwM4GSeTQJwyOBzpQdJ/Qvh3LI3A39ulEigT0nAhBbCY19ipqWMJEjufosl0CNqE/aEWGxtRGW/2czE9itD0h8gz4DGEPTYPKuul3TclHzT/DnhC40tYevr0V2MqjP15eGc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=XBfUlYJh; arc=none smtp.client-ip=209.85.215.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="XBfUlYJh" Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-5c229dabbb6so3222023a12.0 for ; Mon, 04 Mar 2024 10:49:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578176; x=1710182976; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=cMb+PmcOht+K9M0r7eBe/cOsz5NTpNrdAZ0O4xFPS4c=; b=XBfUlYJhMBybjlOMNRAj5jluBu/WLtbNctsJM++zZaY68hcfA2Mwo6tFe+9ub90Xwl fsIf/a+NPH9h02da4izV6Qhx2PerYhs1hZWzpgExEn4rVjwXYDZP801/Sm+QZqD1/z1k bq3W5H+cjtOQ3qGJl8/fLYZ2wAoXsPJCv/tUI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578176; x=1710182976; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cMb+PmcOht+K9M0r7eBe/cOsz5NTpNrdAZ0O4xFPS4c=; b=GyAY8d+TxocACMNth+gbB+P++eL6cbburp9PMDQT02xdARB9ke+nW1RQiXJB60/h/L BbBwZAvluIesjiGzZzvH+s6YPrkG0nB9BJmFGXFAQJQhqp5ahcsNJpiMO401sB/TJq++ SedMccEpw2vtRfHT8ezx6VbFqJC4fld7r8NWkKhUj3sOazF2v6B+GyK+s297TP02XGHL DjfvNV0rJMSpSiaICAt/brl/DqVNk6nA8RfvpU85YLUGx3jKSDuDZ85Ltl2kY06eDppT 6Hkbz6TQmmnc+K8aEocVTsatMkMeSMN4MwyICdM3R68TKVuwM2F0cuWPYYdfnhwQUqbE 8iLw== X-Forwarded-Encrypted: i=1; AJvYcCVI6hIE0WR5mGeto3G05zRTlOXKwBBTO/ZIXH+KRykvw3Wq+9Z5ciLntL4APOPHeqeT6ZdCD1gh914Q/7ljTZwXhSgxw+O+TUZXvimQ2v4L X-Gm-Message-State: AOJu0YzXNOBQisa9/Eb3RHyQ+NLD+pZdzsLwhBsRObUe8AkMRSioixmr cYSwHRSWQ0KPHsf0Z5HwpLf8Aq5w0ZrQmhkli5Yh19s18GP00Y2I49oXe56UDg== X-Google-Smtp-Source: AGHT+IHXfzDDi+Jk/MGWJiolbgqaEdJ79sjoSCtqB+82MCn/uMPrW4nNSDO9Xzsngfqy/Yg749crOw== X-Received: by 2002:a05:6a20:a11a:b0:1a1:4a21:1fe3 with SMTP id q26-20020a056a20a11a00b001a14a211fe3mr1759584pzk.0.1709578176143; Mon, 04 Mar 2024 10:49:36 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id z12-20020aa785cc000000b006e56e5c09absm7810419pfn.14.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, linux-mm@kvack.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Christian Brauner , Al Viro , Jan Kara , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 1/4] slab: Introduce dedicated bucket allocator Date: Mon, 4 Mar 2024 10:49:29 -0800 Message-Id: <20240304184933.3672759-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5798; i=keescook@chromium.org; h=from:subject; bh=h85WkZi4o3uylzu/3xQb8d5MHb8DhVgIptaT/36yfQM=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8a2IWxCB3p2pd4ASVvCAfbFqAl2DgpfxWQ QjMAXgEaQyJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A Ju0qD/9wLY1KtAVlKpiIcbRaHdOPbTRV4/D+hFxL5B9cNYkqbIS1fUdUJI71wBUD6kJnhCd9kCz zY7AbWXcvcgkl2cA36q3sg5ftbAUAugShF8SRrO7cuJBDBjz61Sd3q8a2ajePTuRLXO+IkiOZSW fEs0uw7D3bTOvVIQAaqxYIRhm5g0wDeFJcikNAE06pyX++iA/ePzCLUTui8hhrErnor+Eok1Gio km/LhI+jGhbmoV8EFNFn5yCij/hBhmf/m80ThCIvRs4Lrfs+Jc6NOeSHI0vjyiNxh2dY+XB5kpD yrScvBaBU8MD0PtoCFyo3sqIlhB8epaO9WymgCqRuF+mYuac6RjWgjZh2wBApo+SwpQFUb8g2fH as59RRHY0OQj+s75GtR8Ra9PHvO03ZpOGrKZj/tZqCkbIt92ysyof2t2O2n5yBLKAnTWrUAbw5g SUF7DF0cRG3BfxkZknrhUe6vrhx7uHHB3EHgs3aqEPbc15a38JptIoGR6vga6dtfq38DvPQguDC 2FQBjQRAQbIhYnATKR31hLJTYiwQ2n+HwHoOW0NawX/LV5lAFUf/Z6+hHodr5UK8PFA6Nd+44eM BnNhe+/usfeJyldh8jlzjBfT3UJIcUYGR+sfEjSE48hTeze4iwwNvv/OMOHmv417pCMNY8ohvDd m7Otqn2ryvvKzHg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Dedicated caches are available For fixed size allocations via kmem_cache_alloc(), but for dynamically sized allocations there is only the global kmalloc API's set of buckets available. This means it isn't possible to separate specific sets of dynamically sized allocations into a separate collection of caches. This leads to a use-after-free exploitation weakness in the Linux kernel since many heap memory spraying/grooming attacks depend on using userspace-controllable dynamically sized allocations to collide with fixed size allocations that end up in same cache. While CONFIG_RANDOM_KMALLOC_CACHES provides a probabilistic defense against these kinds of "type confusion" attacks, including for fixed same-size heap objects, we can create a complementary deterministic defense for dynamically sized allocations. In order to isolate user-controllable sized allocations from system allocations, introduce kmem_buckets_create() and kmem_buckets_alloc(), which behave like kmem_cache_create() and like kmem_cache_alloc() for confining allocations to a dedicated set of sized caches (which have the same layout as the kmalloc caches). This can also be used in the future once codetag allocation annotations exist to implement per-caller allocation cache isolation[1] even for dynamic allocations. Link: https://lore.kernel.org/lkml/202402211449.401382D2AF@keescook [1] Signed-off-by: Kees Cook --- Cc: Vlastimil Babka Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Andrew Morton Cc: Roman Gushchin Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: linux-mm@kvack.org --- include/linux/slab.h | 26 ++++++++++++++++++ mm/slab_common.c | 64 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+) diff --git a/include/linux/slab.h b/include/linux/slab.h index b5f5ee8308d0..4a4ff84534be 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -492,6 +492,16 @@ void *kmem_cache_alloc_lru(struct kmem_cache *s, struct list_lru *lru, gfp_t gfpflags) __assume_slab_alignment __malloc; void kmem_cache_free(struct kmem_cache *s, void *objp); +struct kmem_buckets { + struct kmem_cache *caches[ARRAY_SIZE(kmalloc_caches[KMALLOC_NORMAL])]; +}; + +struct kmem_buckets * +kmem_buckets_create(const char *name, unsigned int align, slab_flags_t flags, + unsigned int useroffset, unsigned int usersize, + void (*ctor)(void *)); + + /* * Bulk allocation and freeing operations. These are accelerated in an * allocator specific way to avoid taking locks repeatedly or building @@ -594,6 +604,22 @@ static __always_inline __alloc_size(1) void *kmalloc(size_t size, gfp_t flags) return __kmalloc(size, flags); } +static __always_inline __alloc_size(2) +void *kmem_buckets_alloc(struct kmem_buckets *b, size_t size, gfp_t flags) +{ + unsigned int index; + + if (size > KMALLOC_MAX_CACHE_SIZE) + return kmalloc_large(size, flags); + if (WARN_ON_ONCE(!b)) + return NULL; + index = kmalloc_index(size); + if (WARN_ONCE(!b->caches[index], + "missing cache for size %zu (index %d)\n", size, index)) + return kmalloc(size, flags); + return kmalloc_trace(b->caches[index], flags, size); +} + static __always_inline __alloc_size(1) void *kmalloc_node(size_t size, gfp_t flags, int node) { if (__builtin_constant_p(size) && size) { diff --git a/mm/slab_common.c b/mm/slab_common.c index 238293b1dbe1..6002a182d014 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -392,6 +392,66 @@ kmem_cache_create(const char *name, unsigned int size, unsigned int align, } EXPORT_SYMBOL(kmem_cache_create); +static struct kmem_cache *kmem_buckets_cache __ro_after_init; + +struct kmem_buckets * +kmem_buckets_create(const char *name, unsigned int align, + slab_flags_t flags, + unsigned int useroffset, unsigned int usersize, + void (*ctor)(void *)) +{ + struct kmem_buckets *b; + int idx; + + if (WARN_ON(!kmem_buckets_cache)) + return NULL; + + b = kmem_cache_alloc(kmem_buckets_cache, GFP_KERNEL|__GFP_ZERO); + if (WARN_ON(!b)) + return NULL; + + for (idx = 0; idx < ARRAY_SIZE(kmalloc_caches[KMALLOC_NORMAL]); idx++) { + char *short_size, *cache_name; + unsigned int size; + + if (!kmalloc_caches[KMALLOC_NORMAL][idx]) + continue; + + size = kmalloc_caches[KMALLOC_NORMAL][idx]->object_size; + if (!size) + continue; + + short_size = strchr(kmalloc_caches[KMALLOC_NORMAL][idx]->name, '-'); + if (WARN_ON(!short_size)) + goto fail; + + cache_name = kasprintf(GFP_KERNEL, "%s-%s", name, short_size + 1); + if (WARN_ON(!cache_name)) + goto fail; + + b->caches[idx] = kmem_cache_create_usercopy(cache_name, size, + align, flags, useroffset, + min(size - useroffset, usersize), ctor); + kfree(cache_name); + if (WARN_ON(!b->caches[idx])) + goto fail; + } + + return b; + +fail: + for (idx = 0; idx < ARRAY_SIZE(kmalloc_caches[KMALLOC_NORMAL]); idx++) { + if (b->caches[idx]) { + kfree(b->caches[idx]->name); + kmem_cache_destroy(b->caches[idx]); + } + } + kfree(b); + + return NULL; +} +EXPORT_SYMBOL(kmem_buckets_create); + #ifdef SLAB_SUPPORTS_SYSFS /* * For a given kmem_cache, kmem_cache_destroy() should only be called @@ -934,6 +994,10 @@ void __init create_kmalloc_caches(slab_flags_t flags) /* Kmalloc array is now usable */ slab_state = UP; + + kmem_buckets_cache = kmem_cache_create("kmalloc_buckets", + sizeof(struct kmem_buckets) * ARRAY_SIZE(kmalloc_info), + 0, 0, NULL); } /** From patchwork Mon Mar 4 18:49:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581016 Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7056978B44 for ; Mon, 4 Mar 2024 18:49:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578179; cv=none; b=cB5N0ouw13fTWsX1t5QM8Gm+Wu5Jj/V9fMhm/6D+XnWc82rKz3K7kdRgqVn1KTZEvrA9fk8dvTbangekfbL9EAApRj1XiK5AY0WQ5S9i6HIEsmAwl7kbfcOaY9KR47XUjO16PmKktur6EGd1WNE5bpnMmsIZrcs/qPM9srCWJFs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578179; c=relaxed/simple; bh=+zltM60WJIwhQhbYbj+QC0RcHFfEEaTaC5b3PkagfmU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=coXgbivEBXWucbVNO3ZIz9bro1jRgZTluTG7ZK2xVAl4XaSam1hI26ZEgsM/lvqDBO3YEcmOaOL2KkQWS4+o77c88vwAT0qjXpnJCE7+pknPn+Me/jo+NeGkvZsvxyES/0rOxIdZr/NMNDaSoiEUg2HDFRNvgLa6CtumUXaFaq8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=lnAxA0LX; arc=none smtp.client-ip=209.85.215.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="lnAxA0LX" Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-5cfd95130c6so3175846a12.1 for ; Mon, 04 Mar 2024 10:49:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578176; x=1710182976; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=63pQSv4lgdcPPxgjmIdkeCTgPw+ykuMnj3qldPskCm4=; b=lnAxA0LX5r4TexID833cxBb9m6AYk1kuPjjHNW75Uz5yV5mnYRoxey8+d/FilyimRc z6bcJsRjZhuOgaGrcoPoZjEjOD7lTn6SCdPL9Egl121TaxJLgeYqQLiPxoUVz/ArfXce 2ZxCUOR4cid/r/gD9cESFTgMJ2GsjxvVqVbzc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578176; x=1710182976; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=63pQSv4lgdcPPxgjmIdkeCTgPw+ykuMnj3qldPskCm4=; b=rk1+g0uR4OFymuvX2kAlbEO6iOZqP2H/CvjXeIoutaF4VobgSX+mU1l+3X3LhTU/LQ /rSsY69NmC8DRKXsBQ6hh4PuboJcYJ7SecFMY4niH5gkuhQW/H4/n5dBTH9afavJYD2R srz/SEsrmoTXPuUOkiiFMYsnkErrBH6Nd8zoapKfwTOHRKGV1j4Bq+0kr7MNA8/6ovaf MSjryrcMIgZSaWspNnLBB39lCeYaGEdJ1Qz+iRmYxNGVkHBnG8qr3bAqnMFJvy6jBLuA N92QB6cKdiFkze2RcWN1WYcaSqtC2QwQnoBC0zt1p2P3xjvb+7yOji18nh5NvTQ2/6ys 5hbA== X-Forwarded-Encrypted: i=1; AJvYcCWzM8LstJwksPl5uFmVm4ClgtJDt2zeIZl0J7nTTB/WL+56iGD1L9L5GJj25L17tjiNkHWc9X35PHna5PFT/JHnR0dTQMQ3bjLN46Lzmmxo X-Gm-Message-State: AOJu0YwXvVx8iyEhQKa2OJr3P28t1qD5dG/9JdAQDcdoYjGhzBAHm5oP JlHCgwxr3sKtwnPpJNreQCaK8AzcM8gRkApSE7sYLOSM/zij++34RVt8Hij2MA== X-Google-Smtp-Source: AGHT+IEqbrBUCeaoycN6eZ+VoJQJ/3ekxM3Ni9GrmrAmVAhx541ISPKoahwiO20Sd0vgoGv+eX/7cQ== X-Received: by 2002:a05:6a21:9214:b0:1a1:4842:6760 with SMTP id tl20-20020a056a21921400b001a148426760mr1903106pzb.50.1709578176499; Mon, 04 Mar 2024 10:49:36 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id j4-20020a654284000000b005d8be4c125csm6743414pgp.80.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Christian Brauner , Al Viro , Jan Kara , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 2/4] ipc, msg: Use dedicated slab buckets for alloc_msg() Date: Mon, 4 Mar 2024 10:49:30 -0800 Message-Id: <20240304184933.3672759-2-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2289; i=keescook@chromium.org; h=from:subject; bh=+zltM60WJIwhQhbYbj+QC0RcHFfEEaTaC5b3PkagfmU=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8qRUAcVCqu4hpjGv4CjmdHzSAnbUNg4er3 NYamCewr9+JAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A JuDzEACBBwraGVldgENLbkSYf63dOOHOPJEiqhaSkAxMKXMPigi7yQdQbfcNSnwgtebo1L2uUYv 8a5GjWZgg0pW2K8BJCfxaWqaOKGcKcaQl1JGzOhYIznQhTvy3eFL7liqoKr/iyqINgJllEJw5u1 73nGpA9SrpjgMVQ1WWjUKo3CDRewIUR0dTk28fcGEgg2RubRBocB+ojMwSQvPfl2WwXNNJ6NnaM t1jPN5TOfmjkQwM+IKkwdXSau+eNTMhtba3hE02RRu1OPtszIgPzv9e6R7LQqcPA+z5Nnw9Mx4y ZbqEuw8j6jqARnWfEt9pH8SBkxg5A5JD8uhSVvD9eLQTvHQ47gbqoIV3OvqhNEVQB2mMxiFpJIK NlLkEb/nSKSv3ezcvBEPp9sNggeP6uknRz72aj7v0lLBeL9dnwoPjQS8Vx4tIco3WJcVgCiOxes 11aqWUfxoQSK/Hm/2uAQSZRBPq9t11u4mLp4PCdwiyhfBdIqhHXQUXwKfqAd5M95kCOWSger5J9 de8D2cgNhvOQlrVe+1Oj+J515SQVuJJH4p1jmyS5NEs9nXqR8qExyhvPhjm7ka/HrKG77o3MS0F 7hijfdr4qYUQTGuK0lTaECipjA3875yLPsHC4EB0tB+xynBLCgMVx7JT6jFuddPDRtCkf8QdmaT L+aT5CFzJLRrfWA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 The msg subsystem is a common target for exploiting[1][2][3][4][5][6] use-after-free type confusion flaws in the kernel for both read and write primitives. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in use: # grep ^msg_msg /proc/slabinfo msg_msg-8k 0 0 8192 4 8 : ... msg_msg-4k 96 128 4096 8 8 : ... msg_msg-2k 64 64 2048 16 8 : ... msg_msg-1k 64 64 1024 16 4 : ... msg_msg-16 1024 1024 16 256 1 : ... msg_msg-8 0 0 8 512 1 : ... Link: https://blog.hacktivesecurity.com/index.php/2022/06/13/linux-kernel-exploit-development-1day-case-study/ [1] Link: https://hardenedvault.net/blog/2022-11-13-msg_msg-recon-mitigation-ved/ [2] Link: https://www.willsroot.io/2021/08/corctf-2021-fire-of-salvation-writeup.html [3] Link: https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html [4] Link: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html [5] Link: https://zplin.me/papers/ELOISE.pdf [6] Signed-off-by: Kees Cook --- --- ipc/msgutil.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ipc/msgutil.c b/ipc/msgutil.c index d0a0e877cadd..36f1aa9ea1cf 100644 --- a/ipc/msgutil.c +++ b/ipc/msgutil.c @@ -42,6 +42,15 @@ struct msg_msgseg { #define DATALEN_MSG ((size_t)PAGE_SIZE-sizeof(struct msg_msg)) #define DATALEN_SEG ((size_t)PAGE_SIZE-sizeof(struct msg_msgseg)) +static struct kmem_buckets *msg_buckets __ro_after_init; + +static int __init init_msg_buckets(void) +{ + msg_buckets = kmem_buckets_create("msg_msg", 0, SLAB_ACCOUNT, 0, 0, NULL); + + return 0; +} +subsys_initcall(init_msg_buckets); static struct msg_msg *alloc_msg(size_t len) { @@ -50,7 +59,7 @@ static struct msg_msg *alloc_msg(size_t len) size_t alen; alen = min(len, DATALEN_MSG); - msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL_ACCOUNT); + msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, GFP_KERNEL); if (msg == NULL) return NULL; From patchwork Mon Mar 4 18:49:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581019 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 26D7679921 for ; Mon, 4 Mar 2024 18:49:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578182; cv=none; b=GMvHdyxnqzK0/LCdjZouB8HVgUz74LMuRpN4CVeCL3uDf02L1K5M5QD6rG/FvOBcCJT/3InpYF6Q2C4CkB9JOoFLnhs/kpz4ogtwMVT8YM1V5jBAUxP3/5TBBrhsW/1jryTC04oEM0eqsmbVdxfP2P4TFiRADj92TEOi6Pkh8pc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578182; c=relaxed/simple; bh=IcLElAry6DIoRKKwJQmpd7ju+FKDVUugrCBgj64Jc1w=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=fV27Zn9qxV18CWLpmVUDu3UdPNAdKZze/AiXZuQNiJUHg24GzzEIGy4QETClHiuyn84cgY3jSSmSy+/C92IcZ2PYZfdo6LWpU0CZdY3FoSSudPCHYMtCKdQDCM0ikkqKF3RuSXytpqUXgGYJvdZaPqkc9FTSg0NhyEBJqUeOsiw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=FjOMYjnR; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="FjOMYjnR" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-6e6092a84f4so1263348b3a.0 for ; Mon, 04 Mar 2024 10:49:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578179; x=1710182979; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=FjOMYjnRMCw8a5h5ArmSEPQ6udrpaxW+1c0RexEdjfVm9cpDln9PewKj+qmiD09/rq jbSGrBJ9sZAN6kkLxylO+qxRHMFx0vrQQZyEoWwU3VHNHvjNflgYvjbKKAz2C2Lc5c9N Mn/XvuCQamq9Qf/t1fVTySzbuf+Sr8pTRa+CE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578179; x=1710182979; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2QOKxvJdszgSExOijEeIBqvAxDpXCtl9o7KCQ12P01Y=; b=IdPlY3rwtARbeGgNSiftK4RfD0JDuqosBI/7f3UBA2E77+fGVDO1c9GQqN/LYIUJRi 6grg5SxmJfllGa9Pykw2MzZ8/e0bw89xdAw+WuE5ljRh88VWk4miyzQBoK0dc0BX7Pzg F2GW6HW3ggrevK4C2nKRWwaSG/5sOK79jIFmhTWuBiFqpmMnZoqKoUsrn6u7dN6NAloA 7GWpRxFLAVvk/4dXx/RYXfspJDZZL2hfnqCeBdybKVWk9xt0BBQrW60ogT4XgcvHhUM0 dMjbymOuGwCek9eno254QdLwGPzD/PTpWyjfpLx7Mu5KuAp8H72C+KvmGQ8Xf2fyslV9 d4wA== X-Forwarded-Encrypted: i=1; AJvYcCUL/DwGm48DxxZg9GtZfq9MT8wHj/44MqRXxtm5NVEe8mvaAcJpmcklECx2pdMrpnkAqu15Ne48GfLU2O59Mke2EeAPC87N/zO3iq1DsLwy X-Gm-Message-State: AOJu0YzCIo+ToTP4u4/ZpLkD1CdPwZTNPK8tVaNhrN7mEcOyG/ZR4mqZ eUFiFVLhFu5xRUmxv+5eZkRy/+5aAocLJtJnrwKntUS3eZXKx8u2UuJ4qvDySQ== X-Google-Smtp-Source: AGHT+IGILIudDoOhkhQCWTyG9z0DMQjNf1OD2uCgU2558fLWKJP3m4244pk1XqBrh1eKa3auyU02eA== X-Received: by 2002:aa7:88c1:0:b0:6e5:5425:d914 with SMTP id k1-20020aa788c1000000b006e55425d914mr10540158pff.2.1709578179470; Mon, 04 Mar 2024 10:49:39 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id r27-20020aa79edb000000b006e60c08cbcasm2881132pfq.50.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , Christian Brauner , Alexander Viro , Jan Kara , linux-fsdevel@vger.kernel.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH 3/4] xattr: Use dedicated slab buckets for setxattr() Date: Mon, 4 Mar 2024 10:49:31 -0800 Message-Id: <20240304184933.3672759-3-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1560; i=keescook@chromium.org; h=from:subject; bh=IcLElAry6DIoRKKwJQmpd7ju+FKDVUugrCBgj64Jc1w=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8RUV3Nml6+beLYoX/gI6MaxpEQEieiV1Pk LAMHZWkh1eJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A JgarD/9HvGby2B7eoqRlayCbyDlLBOSIiVV2Bq+vUUsC8Ne0FV1zyqgFRQrXbQ2G6VGoWXimSlm M1jvsW/Y99i2kQDWqeDEZeZf+LehlADDm5Vd8pmJfMMgX19BF898FQYPT7s7OKOxOJ4T/GuE1Kf f8BRgEGLrWxyrMYUyG5/wFYfmfEzazDwiU+A/d2eMxhnYFT6e1elFQ0FweaUabd1+ZCJwV5UdWh HIyGFxL/YTavdVnf68HYBNALeF2lzUERVyzafZOv6WzhMzem7sDreYdkBpWwU4Nvafa5vCB+mCZ kz+tSe+uPkTDLUvM18O8w9hPQ0ywaf1CFBDkCciseVfUKVnH06WlWb84AbCwLv1KSDl6ipWRLxU 84NhknBpAY4fgIguhU0kDs83NhdIl/kn10T/oubIkmY5wdavroHRaFjSlkw/VAeVdJCOOH+U3b9 AJDGgUmwEUlmq7b731/mixhLBrz0CTKq8Aa59nDba3ji+Utrd7I1HKHwMPTcsPrBIVtK2QspH+t pcBzTrTkEuaW7vRD41WXoqxhSJ+mUK3+SKCFafsj0ZaMq2qMA977BazfKFPlNrWRRWzRrteGmk1 Q8c9m2anBqS3EOtpP7bZ2OHyh5VlDQiLJP6Mo78p0Tkgsf+LU7XH1gWUSibuhbnTREFTie5DhAK x63js6NDKJKKoCA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 The setxattr() API can be used for exploiting[1][2][3] use-after-free type confusion flaws in the kernel. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. Link: https://duasynt.com/blog/linux-kernel-heap-spray [1] Link: https://etenal.me/archives/1336 [2] Link: https://github.com/a13xp0p0v/kernel-hack-drill/blob/master/drill_exploit_uaf.c [3] Signed-off-by: Kees Cook --- Cc: Christian Brauner Cc: Alexander Viro Cc: Jan Kara Cc: linux-fsdevel@vger.kernel.org --- fs/xattr.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/xattr.c b/fs/xattr.c index 09d927603433..2b06316f1d1f 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -821,6 +821,16 @@ SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name, return error; } +static struct kmem_buckets *xattr_buckets; +static int __init init_xattr_buckets(void) +{ + xattr_buckets = kmem_buckets_create("xattr", 0, 0, 0, + XATTR_LIST_MAX, NULL); + + return 0; +} +subsys_initcall(init_xattr_buckets); + /* * Extended attribute LIST operations */ @@ -833,7 +843,7 @@ listxattr(struct dentry *d, char __user *list, size_t size) if (size) { if (size > XATTR_LIST_MAX) size = XATTR_LIST_MAX; - klist = kvmalloc(size, GFP_KERNEL); + klist = kmem_buckets_alloc(xattr_buckets, size, GFP_KERNEL); if (!klist) return -ENOMEM; } From patchwork Mon Mar 4 18:49:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13581018 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D55E078B56 for ; Mon, 4 Mar 2024 18:49:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578180; cv=none; b=SFJFOhN46koDpy76dqQDapiv27yhWnd6BQG8KO2ec7xqXqoWrOVmpo82/OO5itR4CSKSOZxjbpFyb+NlOMOuiwjar7ATeNTgRJSLUL5npLZcWrJt25RyU/dvNPpfrtDCS/7msyAkYdUVgi6yJ21jq/vfalHUp7Z/NexRUN4Hkqs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709578180; c=relaxed/simple; bh=wVlg4Ywlqm3758Z/+rtNyin5k6LCR9PFs+qzYTfk1+I=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=G3rK2zTWa7VlcXQWpF3l4Ap8GtFM/L+BdIbjpypWQ3I6Hptd2PfczSRCK8xlAhY0YwtJSTUiECgSTFCEoz+8c6G/Q3NE6fLFF3trhcP860B/cCa70r9+6V/FiYcbh/ZTJ2B7/s3davxnQSvmfZtPWJ5BeIiOjxikTbg5kL4BQoI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=QtWSVN+b; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="QtWSVN+b" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-6e5dddd3b95so1867458b3a.1 for ; Mon, 04 Mar 2024 10:49:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1709578178; x=1710182978; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=3eg+OHwarPCDDbCJMvwZ5D9ntaRfgGqvBfyy5rCCcVU=; b=QtWSVN+biVvOgumsC5IFUE1vZ+34tur9nBswjI6nqffLeoPL+bkKPDSv6J0st99OOD dkVSC2n5aZomvj3tP14ymJt8A3qaAtV+UncE1/n6Y5cQlRSJYtsn8Dic9E8JOr704Rf4 z2/8nf3ufHIaNR3NZI8JQVQ0wgfDiOSTxC9z0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709578178; x=1710182978; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3eg+OHwarPCDDbCJMvwZ5D9ntaRfgGqvBfyy5rCCcVU=; b=nyJ1LpTevjRLmHKpZJHFOL+YypseGn3Xve/N/iMz2rgyX1MhVgMe4wyCaDkZS1wgHf irCPhlZzQNBqwiX9CUH0z6VZjqkwuJyyVgcLOSVeNAHXoRx34C52ipoKnTejwHqxRjMu MV+oSAIr7aK+HUkZcbIF1b929CX477APLQrx8rdBqvuGc3JM4cLzQB/Bo+Ntk0C30/Nv lnj8R5Xo6Au/85bntIZmle16ut3vXdL1tAD7eO9/hkr/FbK2vhwocwZgW8zHeIg6IJNZ mVxPxeC0QV60brv/WIP0lpzynJwa10BVT4CDw1LE7MmZtjPPGRqsI96yTrCYzwDRRxx0 Vp1w== X-Forwarded-Encrypted: i=1; AJvYcCVkr6PppsBMFQtSwPkJICgJhf5rgVH9qtitPxp42FgX/nfknDdQKD7mKG3xgutHvqMvK4q6/nmAlbwNB0S3A4V11p75PXt2me0xhgXkSlW6 X-Gm-Message-State: AOJu0YyyNy9W+gQlDQt/sq/ulpisFd7kFgmbeo+5ksge8RzcuhoAiYJj t+xzYCitPEGZrouesT3sbTkOnuYhK/7mTccda+idfZ0Xo9LIfCjdzAKwdGw2tQ== X-Google-Smtp-Source: AGHT+IGLXRXXimciJBhdk/dIb4Wb2zbKj+H0Uz/ceqDu67vjZT0fdQjMBcnwKVhjTqa97KV6aSVCaA== X-Received: by 2002:a05:6a00:2d1e:b0:6e0:50cb:5f0a with SMTP id fa30-20020a056a002d1e00b006e050cb5f0amr397502pfb.12.1709578177665; Mon, 04 Mar 2024 10:49:37 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id q67-20020a634346000000b005dc49afed53sm7759425pga.55.2024.03.04.10.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Mar 2024 10:49:34 -0800 (PST) From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , Andrew Morton , linux-mm@kvack.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Christian Brauner , Al Viro , Jan Kara , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 4/4] mm/util: Use dedicated slab buckets for memdup_user() Date: Mon, 4 Mar 2024 10:49:32 -0800 Message-Id: <20240304184933.3672759-4-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240304184252.work.496-kees@kernel.org> References: <20240304184252.work.496-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2330; i=keescook@chromium.org; h=from:subject; bh=wVlg4Ywlqm3758Z/+rtNyin5k6LCR9PFs+qzYTfk1+I=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBl5he8UYVHiwP9jlErQNW8kOwDMEcuQZnM208D3 8K1ECbNwiWJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZeYXvAAKCRCJcvTf3G3A Jl+iEACLE6xmcDHNPJUI5v4X0mux03kdgYRX+BLElIYHYI7U0wjiKpXajjtdiBhgakpjXtztCWM P2osPYx1h7voVbtUuUWxNhSonJpnB0Nm+gAimqzvFzjmcT3+iOzWMdkuQIrnE6UmT3zpJFc6XCU g2QFAVxdiGa3N2vDovfT4v30vBd49SiQha0Ku6yG7HjCQGZlzRr99NRAgutT/m9cF15+jsLLygf 27uNjMhYBScQ/t1LffYt6H0XCkJx/H2JYQjJ+BPC2G+PF99sedHnXOHDSkQv8x5Hl4PIhPslxFR 91ZyIfi2gek3k1qy2AtzadMoj202Ge/xe12M85LUqMOsf6P+R5s8/g8DiXl4l7Id7cPOTD5r9BS SNlQ7S2KaIK2wznKMO/HoLjyqgjZhMD7IeID0qZ3TfjZ8BbqOuvRGqLMgn8tzc3LAB8agyecsTT g0+xAUJYNoc8NRwjsjVNz+QckpIFcvn8kiUHKXwiZ2Qmorl1p9Fd9x1CQ9sTiJa59YI8DAUJ7Hb dQsvxWmevu1RLkIB1tmDdAS2pqIFmK+0m57zvWu5UJnhkIQV+kiDxu0Dd/kq0opljR4/anmfMur 7WnTU2xy/QXL6JGYC1RXjxC4niOzOIZjfPwGZsXbo32sj+XkZkGkZ/jNwB4eNjVnoNor7p7CxLD i3hiwyQiWnJh+Xw== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 The prctl() PR_SET_VMA_ANON_NAME command can be used for exploiting[1] use-after-free type confusion flaws in the kernel. This is just one path to memdup_user() which is designed for contents coming from userspace. Avoid having a user-controlled size cache share the global kmalloc allocator by using a separate set of kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in use: # grep ^memdup /proc/slabinfo memdup_user-8k 4 4 8192 4 8 : ... memdup_user-4k 0 0 4096 8 8 : ... memdup_user-2k 16 16 2048 16 8 : ... memdup_user-1k 0 0 1024 16 4 : ... memdup_user-512 0 0 512 16 2 : ... memdup_user-256 0 0 256 16 1 : ... memdup_user-128 0 0 128 32 1 : ... memdup_user-64 256 256 64 64 1 : ... memdup_user-32 512 512 32 128 1 : ... memdup_user-16 1024 1024 16 256 1 : ... memdup_user-8 2048 2048 8 512 1 : ... memdup_user-192 0 0 192 21 1 : ... memdup_user-96 168 168 96 42 1 : ... Link: https://starlabs.sg/blog/2023/07-prctl-anon_vma_name-an-amusing-heap-spray/ [1] Signed-off-by: Kees Cook --- Cc: Andrew Morton Cc: linux-mm@kvack.org --- mm/util.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mm/util.c b/mm/util.c index 5a6a9802583b..818e74d11fb6 100644 --- a/mm/util.c +++ b/mm/util.c @@ -181,6 +181,16 @@ char *kmemdup_nul(const char *s, size_t len, gfp_t gfp) } EXPORT_SYMBOL(kmemdup_nul); +static struct kmem_buckets *user_buckets __ro_after_init; + +static int __init init_user_buckets(void) +{ + user_buckets = kmem_buckets_create("memdup_user", 0, 0, 0, UINT_MAX, NULL); + + return 0; +} +subsys_initcall(init_user_buckets); + /** * memdup_user - duplicate memory region from user space * @@ -194,7 +204,7 @@ void *memdup_user(const void __user *src, size_t len) { void *p; - p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN); + p = kmem_buckets_alloc(user_buckets, len, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM);