From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8F1AC433E1 for ; Sat, 15 Aug 2020 18:55:39 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7FB2523B6F for ; Sat, 15 Aug 2020 18:55:39 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="GPHj7mF5" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7FB2523B6F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 007316B0002; Sat, 15 Aug 2020 14:55:39 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EF9076B0003; Sat, 15 Aug 2020 14:55:38 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DE8116B0005; Sat, 15 Aug 2020 14:55:38 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0183.hostedemail.com [216.40.44.183]) by kanga.kvack.org (Postfix) with ESMTP id CAF496B0002 for ; Sat, 15 Aug 2020 14:55:38 -0400 (EDT) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 85559824556B for ; Sat, 15 Aug 2020 18:55:38 +0000 (UTC) X-FDA: 77153706756.05.dog23_370e63827007 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin05.hostedemail.com (Postfix) with ESMTP id 61D351801D430 for ; Sat, 15 Aug 2020 18:55:38 +0000 (UTC) X-HE-Tag: dog23_370e63827007 X-Filterd-Recvd-Size: 3861 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf35.hostedemail.com (Postfix) with ESMTP for ; Sat, 15 Aug 2020 18:55:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=SYhsdz9Ikw/5Id67XdrFAG6RYY/GnifUtuavkK2F1mo=; b=GPHj7mF5tQxFUHGIb+vUHBhFvb viu4v6hOIabQCCvC2ShC+wg5VDEpFLVz3pQ9emHprrtHALfAeBm8tyXyXzr+5ScH78gcFybPBuBFp 8JoyUaq4GaPGa9sNYZ/RdQWnBZZO5NgJVySKsAbK0v35o2Mt5iRFpJBOy6SDfSAL5zCQathZaYN45 aIKp7Fxx83adx921tPLvn93HeDfLHLek7YBiuGjhTMdquC435ptpkXDvrPlyaAXEnoK34Yk+ugwbX /++ZiDWW2wuYR6x4WAiq2ZCcu3A1BddzYWUKJhR6Kb9jmMzcxus+gohduHlSqtPrS6HYuabKex/Sf h/l9nB9w==; Received: from willy by casper.infradead.org with local (Exim 4.92.3 #3 (Red Hat Linux)) id 1k71KR-00061N-Qf; Sat, 15 Aug 2020 18:54:55 +0000 Date: Sat, 15 Aug 2020 19:54:55 +0100 From: Matthew Wilcox To: Alexander Popov Cc: Kees Cook , Jann Horn , Will Deacon , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Masahiro Yamada , Masami Hiramatsu , Steven Rostedt , Peter Zijlstra , Krzysztof Kozlowski , Patrick Bellasi , David Howells , Eric Biederman , Johannes Weiner , Laura Abbott , Arnd Bergmann , Greg Kroah-Hartman , kasan-dev@googlegroups.com, linux-mm@kvack.org, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, notify@kernel.org Subject: Re: [PATCH RFC 1/2] mm: Extract SLAB_QUARANTINE from KASAN Message-ID: <20200815185455.GB17456@casper.infradead.org> References: <20200813151922.1093791-1-alex.popov@linux.com> <20200813151922.1093791-2-alex.popov@linux.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200813151922.1093791-2-alex.popov@linux.com> X-Rspamd-Queue-Id: 61D351801D430 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam01 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Aug 13, 2020 at 06:19:21PM +0300, Alexander Popov wrote: > +config SLAB_QUARANTINE > + bool "Enable slab freelist quarantine" > + depends on !KASAN && (SLAB || SLUB) > + help > + Enable slab freelist quarantine to break heap spraying technique > + used for exploiting use-after-free vulnerabilities in the kernel > + code. If this feature is enabled, freed allocations are stored > + in the quarantine and can't be instantly reallocated and > + overwritten by the exploit performing heap spraying. > + This feature is a part of KASAN functionality. After this patch, it isn't part of KASAN any more ;-) The way this is written is a bit too low level. Let's write it in terms that people who don't know the guts of the slab allocator or security terminology can understand: Delay reuse of freed slab objects. This makes some security exploits harder to execute. It reduces performance slightly as objects will be cache cold by the time they are reallocated, and it costs a small amount of memory. (feel free to edit this) > +struct qlist_node { > + struct qlist_node *next; > +}; I appreciate this isn't new, but why do we have a new singly-linked-list abstraction being defined in this code?