From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBD72EE6456 for ; Fri, 15 Sep 2023 11:00:01 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5E0AF6B0357; Fri, 15 Sep 2023 07:00:01 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 58FD86B0358; Fri, 15 Sep 2023 07:00:01 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3DFD58D0012; Fri, 15 Sep 2023 07:00:01 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 1BBF06B0357 for ; Fri, 15 Sep 2023 07:00:01 -0400 (EDT) Received: from smtpin21.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id E97D6A1045 for ; Fri, 15 Sep 2023 11:00:00 +0000 (UTC) X-FDA: 81238536960.21.097AC18 Received: from mail-yb1-f202.google.com (mail-yb1-f202.google.com [209.85.219.202]) by imf30.hostedemail.com (Postfix) with ESMTP id 27D2B80026 for ; Fri, 15 Sep 2023 10:59:58 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=NpVdj2LR; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf30.hostedemail.com: domain of 3LjkEZQsKCN8NBUUFPSJaaPHPPHMF.DPNMJOVY-NNLWBDL.PSH@flex--matteorizzo.bounces.google.com designates 209.85.219.202 as permitted sender) smtp.mailfrom=3LjkEZQsKCN8NBUUFPSJaaPHPPHMF.DPNMJOVY-NNLWBDL.PSH@flex--matteorizzo.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1694775599; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=PIsfdB6xTDxZC/lwkP7uk8Z8Jcdw9pIYLJmg+xNA39E=; b=4+M+um76jgnr/4vozlUp6X1UtN9iVrVx95VhT+kBjwFIKnCtrcfmkQszFB9IYMMuqcmUFf kMSr7haob8WyfDxJTGJ/q805LUrGG7S40NURxjdzhDCPPx+k/bd7VtLrwuxfowpQ8Fatzg GDPxPiD4WZyEfoK9KkTshFtHd4BYIGw= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=NpVdj2LR; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf30.hostedemail.com: domain of 3LjkEZQsKCN8NBUUFPSJaaPHPPHMF.DPNMJOVY-NNLWBDL.PSH@flex--matteorizzo.bounces.google.com designates 209.85.219.202 as permitted sender) smtp.mailfrom=3LjkEZQsKCN8NBUUFPSJaaPHPPHMF.DPNMJOVY-NNLWBDL.PSH@flex--matteorizzo.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1694775599; a=rsa-sha256; cv=none; b=koe44Tb2AJByhz52iIYAbRT86pLVCF+Obztp7j0GovapG7bnENTRo0yMuu9Ej0oqX6MQJy yqLGq4WFMjl859HGL/xWmD8/JnHVHGyP14dOHQEeH/h2Rodzx07nXTtbtaRuXmjUPIaJcz e9i+hUqwN7eob4jlOnp8ROginkqtrIQ= Received: by mail-yb1-f202.google.com with SMTP id 3f1490d57ef6-d815354ea7fso2255981276.1 for ; Fri, 15 Sep 2023 03:59:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1694775598; x=1695380398; darn=kvack.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=PIsfdB6xTDxZC/lwkP7uk8Z8Jcdw9pIYLJmg+xNA39E=; b=NpVdj2LREu6IrGFbI5iqJH+tMX58Vol2CbVt5Rd0rXCIBe1wYkrTSLbyKDm/Vsg4kp DiZQGm5E2llANYU9Bb9qPirWVILH3z0YJgCBkDPCGKDOgg5b5UaSnhblFyLYTX2sGLhT h8KnEDVHG8qfJU85RZPeVLZqeJbTLRZnPipmj6f1wt/45uNuAKgg7/zNCmdePk6MHAnD Hdm1Cuy09avuv2wYyQm9Dvv89JruEBJ4wR+Wgtyo67aQ6CnYoiJ2e1RR/4juotDiiPdk wMdpODXi/7wS/lIHnJaAMJvE/ctamAY8wNQbqJu27iU8KwPOuiBllg8tTO4Z7QYRd7F7 QgsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694775598; x=1695380398; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=PIsfdB6xTDxZC/lwkP7uk8Z8Jcdw9pIYLJmg+xNA39E=; b=KwbCdfErH8f6fo2p5tCsGbPInTbIiV6RN0NSnNrUbuI4TPo+/Cg/GUv7Od/l7dVAqs 4OMLwOg+QAOHq0DiG0OrM+kVRaHhQYXdrBrrtRWjupvBAVUsNIXr5CZ5X0FfRJpJ4tpo Gw9jYiKDN7hX2vIFW64LE63g1UD79XVuJWax9k55eubUkWUn7OH08xc9Z75Oi3azxjjo bQZQfM+0HKa1DEV1Ho6rIPIIVAnyD2Txgfd+3vo8adgTTZTvLyj5ymPf2Ym4d38G9q8I ERJetI8+NxLvYx758CYnP8fH57XBPlPkUFkysEJcGuyKwdvmtH2Od+tUq8ROkz2L0tmg FmEg== X-Gm-Message-State: AOJu0YyGQ/8ATdyr8TWEe40YosVjCtR0PHnx0A+BY0lJDTb5t0ru/dLZ 3YvT3BxDqaOP0K8zpbry75/fjbK4bqaCgjuBCg== X-Google-Smtp-Source: AGHT+IHof1ICS1lqUlllRxkXI3ZaCAbe0FHMFloFuiAiVd7ISUWF8gEW5L/+IOYmFoxGVNOKnVGZCUEbaXvmEPeHwA== X-Received: from mr-cloudtop2.c.googlers.com ([fda3:e722:ac3:cc00:31:98fb:c0a8:2a6]) (user=matteorizzo job=sendgmr) by 2002:a5b:d10:0:b0:d81:7f38:6d65 with SMTP id y16-20020a5b0d10000000b00d817f386d65mr22869ybp.2.1694775598311; Fri, 15 Sep 2023 03:59:58 -0700 (PDT) Date: Fri, 15 Sep 2023 10:59:27 +0000 In-Reply-To: <20230915105933.495735-1-matteorizzo@google.com> Mime-Version: 1.0 References: <20230915105933.495735-1-matteorizzo@google.com> X-Mailer: git-send-email 2.42.0.459.ge4e396fd5e-goog Message-ID: <20230915105933.495735-9-matteorizzo@google.com> Subject: [RFC PATCH 08/14] security: introduce CONFIG_SLAB_VIRTUAL From: Matteo Rizzo To: cl@linux.com, penberg@kernel.org, rientjes@google.com, iamjoonsoo.kim@lge.com, akpm@linux-foundation.org, vbabka@suse.cz, roman.gushchin@linux.dev, 42.hyeyoo@gmail.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, corbet@lwn.net, luto@kernel.org, peterz@infradead.org Cc: jannh@google.com, matteorizzo@google.com, evn@google.com, poprdi@google.com, jordyzomer@google.com Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 27D2B80026 X-Stat-Signature: 8mzsc9gxgjkaeicehupedij9gir3ggjx X-Rspam-User: X-HE-Tag: 1694775598-930337 X-HE-Meta: U2FsdGVkX189ZrUER3B5eB3L+WbvFqGbsPBGXIRchF2i81ViBsmT3L6kpYVzkbh8D0kusbi9k+Ga0gST3cOzy5hPWpyylKSET82u6OpUXCQqar48SyDiyP1gweoCTb8YOcMxAaaiGbMZnak+U5oqL/F1l4n1yViGJOXjdjkk99QEK/dE34yIXHuERN7nQ+8Tm2P5kRSbHsf00dWQ+eX1z4uvgI92QA2367SwHR6aUe+KFThHmP77Krf5FzLY1WIxTuAjwPrSea5IjT5gVeV16chB5KoJuyO5+IacFNLrybvO5vTnqIZyAqP231if2B0FRZJtHa19fSp45y19FG0BDu/FM+xcq3FeYzyQH+8vcDF2EapdUAoMd3GT0SrUCZS6e2YIXr1XX74hh5gOytDNdutjdi4rd29RQBQXzk/iuK9lFsM0WS48JQR1GuvdCVzeSAQHqUadkPRbjJRL1Pj0lvw5ylDsU4zj10zxdqZgTrF2tMP+k8Yqr0UAzfRYFwK534GeJ4ns9U61ITfwlo2ELW0LsxjRxedDWQJABT8BSx6JCgFZ5hz/E+V840ed+wY5dtXFnmlr0XzUhOsNeICpEfj0WIoASPbNgcz8heoaaAhzgFqqxbC/L7nLq+GEro6GhGGO0xnEIB4l7P7h07eI4qlWllQ0B7OYUe9CtMq0QvCa/0P47X6NysCP+kmy61vDt6EGwXhLs0N6qsxiEMG5I0Bobb7vdOqlY+r8JvmqsshI12lQTnsvKqoSLA0sf8hiiL5ryKyc+hfNCEEo727mx1q0a0Mnhvvn126g+JjGFlrkEPELJZsufZj8ARFyrERToAoq9rBDH23dy6i/4c59J1S65sJvNVAHPYtdUT0fOPNXnUmiKi38rRthPb3B4Jb5mCK1OHrHy/mbJveJByYOB5uKwfOC+Z4Ti9CaxQaQ6Uskf7gI/PsfTUaPsp0i3DWjc3L+Px4iVLekoK3ud0E pSmY1ZDe seRhl7cv9NL3RswKfvlkNuO5wPBmfl2ya9NdKefeWKYCMILrkCk8+dngfNdABUg2KiWjIb/Vn+OrAt9jy2UJGP2Ak33xnT7yQhPLORBrj3MPGYrQRQiXVncnZ8QvU0IFBvWNIGheJUlG+mNW9XOQE+N+rLP47vhFwKWzeu0dEkG6IIpX2uXTmzAIAriM4y0DH7pTyXzq3iKFYpnbXp1qP5akq3jBpcaspShCHrvvHchtXGl0AAByowfjIWf14HsseSuKa2CMbqA1THj5iAoNoFUo8adc5ADr/W+G+Einr8VG4Br3/jm54jg5aHoFwl29VzmyGf3z5Mn5XxJoHy/BOA/lg/0g2GY27ZgIr406fddALW2WIibRvfdWAF9MoC5bsENEIgP1p3gppyPcrGlouGKrzE4ZZVVyLSNF1S+f6JOjTZ05Q4L3Hs51of+heUWgsM15ilpI3SIxDuWNUUiMXLEjETGpGRbdtfJHWd2LIJ+jjx0UkP1nCJWe3w3gLwWnwjPEbSH8SAiiloOLvpWJcVnOwJBIvT9qKu0AZ3Ih+ZEOvWgtVR+EvqNtQJhURbl1s4nLr3ueUr4t8orFjNejSl6DXP6vjlgqqA5oZBGLq4eGOUUYW0b39cC3H201Qg3atkevU0MVJH4t8ZpvJY2bZHLiijtZmXUW9LGIELlK1whJt3H6lh5y65V6Jj42xKJbWoo/R5aF5C5Z4kXB15gQJYXvwkn0UlBxASuLVRP2SGgKGYmk19OgLYtujbMoOhHBbGr2rPhVll6uaYwxgeJk/5m4EK1A6+uvR7IZbSevsIHSmIMyYIva99Vg4s4qUM+7MxnnQ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jann Horn SLAB_VIRTUAL is a mitigation for the SLUB allocator which prevents reuse of virtual addresses across different slab caches and therefore makes some types of use-after-free bugs unexploitable. SLAB_VIRTUAL is incompatible with KASAN and we believe it's not worth adding support for it. This is because SLAB_VIRTUAL and KASAN are aimed at two different use cases: KASAN is meant for catching bugs as early as possible in debug/fuzz/testing builds, and it's not meant to be used in production. SLAB_VIRTUAL on the other hand is an exploit mitigation that doesn't attempt to highlight bugs but instead tries to make them unexploitable. It doesn't make sense to enable it in debugging builds or during fuzzing, and instead we expect that it will be enabled in production kernels. SLAB_VIRTUAL is not currently compatible with KFENCE, removing this limitation is future work. Signed-off-by: Jann Horn Co-developed-by: Matteo Rizzo Signed-off-by: Matteo Rizzo --- security/Kconfig.hardening | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening index 0f295961e773..9f4e6e38aa76 100644 --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -355,4 +355,18 @@ config GCC_PLUGIN_RANDSTRUCT * https://grsecurity.net/ * https://pax.grsecurity.net/ +config SLAB_VIRTUAL + bool "Allocate slab objects from virtual memory" + depends on SLUB && !SLUB_TINY + # If KFENCE support is desired, it could be implemented on top of our + # virtual memory allocation facilities + depends on !KFENCE + # ASAN support will require that shadow memory is allocated + # appropriately. + depends on !KASAN + help + Allocate slab objects from kernel-virtual memory, and ensure that + virtual memory used as a slab cache is never reused to store + objects from other slab caches or non-slab data. + endmenu -- 2.42.0.459.ge4e396fd5e-goog