From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B302C4741F for ; Tue, 29 Sep 2020 18:35:54 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 206DB221E7 for ; Tue, 29 Sep 2020 18:35:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 206DB221E7 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A06696B0068; Tue, 29 Sep 2020 14:35:53 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 9DC476B006C; Tue, 29 Sep 2020 14:35:53 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8A35F6B0070; Tue, 29 Sep 2020 14:35:53 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0052.hostedemail.com [216.40.44.52]) by kanga.kvack.org (Postfix) with ESMTP id 742F76B0068 for ; Tue, 29 Sep 2020 14:35:53 -0400 (EDT) Received: from smtpin04.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 33055180AD801 for ; Tue, 29 Sep 2020 18:35:53 +0000 (UTC) X-FDA: 77316952986.04.magic26_2b148212718c Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin04.hostedemail.com (Postfix) with ESMTP id 1518580073B8 for ; Tue, 29 Sep 2020 18:35:53 +0000 (UTC) X-HE-Tag: magic26_2b148212718c X-Filterd-Recvd-Size: 5990 Received: from mail-wm1-f66.google.com (mail-wm1-f66.google.com [209.85.128.66]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Tue, 29 Sep 2020 18:35:52 +0000 (UTC) Received: by mail-wm1-f66.google.com with SMTP id x23so5637989wmi.3 for ; Tue, 29 Sep 2020 11:35:52 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=2bxuhq/r6r8osy7pzVzO/JXpG1ASc+MUIPI5gsA7kxI=; b=D8ijbSyM600Wj76AeM2UWjHVA2akZRmBgp8SQZ0Jis5zTg6wA7dbaxaB1vDjg8lhSo 25ZKN9WpHDjR5f3mDmUE9+E2ZVwqa5dkaLh80fFM1OWtkPHQdGytjJD3tDV9ihWvPdvX eNKGFH4OvzuvnPZsPp18kWnDEjQQ26Zgrs9bS9yUiG3fDN2XC6ycGnJu9yyQJKFkABas zmP6zDOo5P/FLkeNeDuo+1uOK0cgfCsACUNf3oqId6v03m2ldi+v7U7eGYGSNJlFyuUL pp3mi9+zSNsNISxNkz+J4q0qN43JyR/k4MiEq6giamDpEnwiKB5n7f2merfG9G+h8zSM NWzw== X-Gm-Message-State: AOAM530SCF7nrdbm3Sl8p5lUn8TJ09Oj134tbwBpHhxeCXWmXuazooT7 N2kj9dinDZxv1PPstegpPNQ= X-Google-Smtp-Source: ABdhPJy9A5JEn21mEASXT5hiuePaz0JL4sNUqlLTquEiKyft5GG7jNH5pWMw/hXwHiK/QazBvkyuwg== X-Received: by 2002:a1c:5685:: with SMTP id k127mr6197810wmb.135.1601404551593; Tue, 29 Sep 2020 11:35:51 -0700 (PDT) Received: from localhost.localdomain ([185.248.161.177]) by smtp.gmail.com with ESMTPSA id b188sm12151271wmb.2.2020.09.29.11.35.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 29 Sep 2020 11:35:50 -0700 (PDT) From: Alexander Popov To: Kees Cook , Jann Horn , Will Deacon , Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Masahiro Yamada , Masami Hiramatsu , Steven Rostedt , Peter Zijlstra , Krzysztof Kozlowski , Patrick Bellasi , David Howells , Eric Biederman , Johannes Weiner , Laura Abbott , Arnd Bergmann , Greg Kroah-Hartman , Daniel Micay , Andrey Konovalov , Matthew Wilcox , Pavel Machek , Valentin Schneider , kasan-dev@googlegroups.com, linux-mm@kvack.org, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, Alexander Popov Cc: notify@kernel.org Subject: [PATCH RFC v2 3/6] mm: Integrate SLAB_QUARANTINE with init_on_free Date: Tue, 29 Sep 2020 21:35:10 +0300 Message-Id: <20200929183513.380760-4-alex.popov@linux.com> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200929183513.380760-1-alex.popov@linux.com> References: <20200929183513.380760-1-alex.popov@linux.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Having slab quarantine without memory erasing is harmful. If the quarantined objects are not cleaned and contain data, then: 1. they will be useful for use-after-free exploitation, 2. there is no chance to detect use-after-free access. So we want the quarantined objects to be erased. Enable init_on_free that cleans objects before placing them into the quarantine. CONFIG_PAGE_POISONING should be disabled since it cuts off init_on_free. Signed-off-by: Alexander Popov --- init/Kconfig | 3 ++- mm/page_alloc.c | 22 ++++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index 358c8ce818f4..cd4cee71fd4e 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1933,7 +1933,8 @@ config SLAB_FREELIST_HARDENED =20 config SLAB_QUARANTINE bool "Enable slab freelist quarantine" - depends on !KASAN && (SLAB || SLUB) + depends on !KASAN && (SLAB || SLUB) && !PAGE_POISONING + select INIT_ON_FREE_DEFAULT_ON help Enable slab freelist quarantine to delay reusing of freed slab objects. If this feature is enabled, freed objects are stored diff --git a/mm/page_alloc.c b/mm/page_alloc.c index fab5e97dc9ca..f67118e88500 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -168,6 +168,27 @@ static int __init early_init_on_alloc(char *buf) } early_param("init_on_alloc", early_init_on_alloc); =20 +#ifdef CONFIG_SLAB_QUARANTINE +static int __init early_init_on_free(char *buf) +{ + /* + * Having slab quarantine without memory erasing is harmful. + * If the quarantined objects are not cleaned and contain data, then: + * 1. they will be useful for use-after-free exploitation, + * 2. use-after-free access may not be detected. + * So we want the quarantined objects to be erased. + * + * Enable init_on_free that cleans objects before placing them into + * the quarantine. CONFIG_PAGE_POISONING should be disabled since it + * cuts off init_on_free. + */ + BUILD_BUG_ON(!IS_ENABLED(CONFIG_INIT_ON_FREE_DEFAULT_ON)); + BUILD_BUG_ON(IS_ENABLED(CONFIG_PAGE_POISONING)); + pr_info("mem auto-init: init_on_free is on for CONFIG_SLAB_QUARANTINE\n= "); + + return 0; +} +#else /* CONFIG_SLAB_QUARANTINE */ static int __init early_init_on_free(char *buf) { int ret; @@ -184,6 +205,7 @@ static int __init early_init_on_free(char *buf) static_branch_disable(&init_on_free); return ret; } +#endif /* CONFIG_SLAB_QUARANTINE */ early_param("init_on_free", early_init_on_free); =20 /* --=20 2.26.2