From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E305C25B75 for ; Mon, 3 Jun 2024 22:45:10 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AF6886B0096; Mon, 3 Jun 2024 18:45:09 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id AA4B46B0098; Mon, 3 Jun 2024 18:45:09 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 96CB76B0099; Mon, 3 Jun 2024 18:45:09 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 78B7E6B0096 for ; Mon, 3 Jun 2024 18:45:09 -0400 (EDT) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id E130280690 for ; Mon, 3 Jun 2024 22:45:06 +0000 (UTC) X-FDA: 82191059412.14.036B46F Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by imf18.hostedemail.com (Postfix) with ESMTP id 8EE5D1C000A for ; Mon, 3 Jun 2024 22:45:04 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=LgLq+8y8; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf18.hostedemail.com: domain of kees@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=kees@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1717454705; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uOXMQm/UktL0k9I+3N/OMLbkAgdsnbLga+CYwzgS0qE=; b=xsC/ByopXnVTHMt3hxk5jFt8XuYudaQLzISjbiq60j+hRAJHHW8TnHEbvwW3o8ShVB9xrE ObQsPld0JCgnHujsDSP36AVTL+0XffQZvx1x6+FiWXHM9auJUEZZYI9CGgCG1PWSpvlNR1 kBKZW/Vfv2j7xC4xn19SxF9Y7V/S1DQ= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1717454705; a=rsa-sha256; cv=none; b=wLFHRcCbKxKSh1gGULL4TPQ5TR6uwSESu3TQUGCbZNXQMlilLfRfmwj0DKgJeplQFohuqi JbMt6GXnmTner1SRy0hy2xDQW4dP8nDGLb7v1uYtpIveJJyzSrMSPdbqjapm4pXXXzjTv7 4QmyngxH9otJBD9VmOBI3G9heTAFW6w= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=LgLq+8y8; dmarc=pass (policy=none) header.from=kernel.org; spf=pass (imf18.hostedemail.com: domain of kees@kernel.org designates 145.40.73.55 as permitted sender) smtp.mailfrom=kees@kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 01F31CE0F88; Mon, 3 Jun 2024 22:45:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A9B4C2BD10; Mon, 3 Jun 2024 22:45:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1717454700; bh=SS7haSNVEINimgm5/W3mtfCykszqT69zvNdWxSykOjQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=LgLq+8y8Z9DNbcbleJK889AVVnanG0dEtt5fKMT90XrX8yhVQXh+DJYOmUBI7RoRr 92hDsbxfH0jlFkbi+R9Sqkv2vkYfpeQWyhYTNoZnLI89Skr/P+hbBMh1M0Z0Zig+Oq gVcGlkOzJB4aP/MlGkVI9O0VFhlfk/cWGKCGNUqeYLcPQloFR9ps99dXIeZChYlhpO Al6nt2qihiHJVIwBqarO7DDgq1Zhsrl5ep4Mn0fXRPp/rivGBk43FftWgOBsrQmBUF 9bTKITNMbFRd5u+qk9Rw3US4QpdF+jLNIwZPzDCD6xEzESRlNqQpgQrpQKxGeffyUT aWai68IuOUsyQ== Date: Mon, 3 Jun 2024 15:44:59 -0700 From: Kees Cook To: Vlastimil Babka Cc: Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , jvoisin , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, linux-mm@kvack.org, linux-hardening@vger.kernel.org, "GONG, Ruiqi" , Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Jann Horn , Matteo Rizzo , Thomas Graf , Herbert Xu , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: Re: [PATCH v4 2/6] mm/slab: Plumb kmem_buckets into __do_kmalloc_node() Message-ID: <202406031539.3A465006@keescook> References: <20240531191304.it.853-kees@kernel.org> <20240531191458.987345-2-kees@kernel.org> <8c0c4af3-4782-4dbc-b413-e2f3b79c0246@suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8c0c4af3-4782-4dbc-b413-e2f3b79c0246@suse.cz> X-Stat-Signature: pcpyk9nwp7e5bthg7darzujse3op7tho X-Rspamd-Queue-Id: 8EE5D1C000A X-Rspam-User: X-Rspamd-Server: rspam01 X-HE-Tag: 1717454704-71303 X-HE-Meta: U2FsdGVkX18jpxqEM2Iwr7UP0VehiYs1h1Xu8ZjGh1BGJlK+GbXZ/lZe5mB/98gzXEsM10jDe+uZaJCE3naJHq6ddB59Y+/Afn9kEt2m76W8XB154G1+xhcpay/7bKWTgCnxLdDpk72APAj6EryfgAfzsYz9E4x5DJdsCMrmKxlLMIU5FwZvQbelVCMYB2GmAHbgpwW0pKOiZu4jBl/dKKuYQGFPJhCQFVJy080MdE9R4pFvn16eNY45/sg+0SoAPYMvUB9x6Ng1Dw9ih7dLCldAWuCFimE0UICAzeGZEMKCj9cdQv4aB5ge8v6dDDVUpXI5ngKEcVUDSfFE4TE94b3RBeAnb/eawkyrSy/77btpuYX0uIU/Xn7zi3dXF946nT3eIh8+74Iidqkp2TjQQ521j3Odup4OrtRQnwtRMuCSGykITT70yzOxyggXZhypByNjTHsh56CXtz1zw028yeo97c0A0vDGYidJ/P5/Kl0DqXbIoNxJRAF67QB/n3JI0o5DbReN/bVWS6wZj8o7GyatuF7tyZt+GBSScrvl1zyKtHaRZd0VNEy0wl/yHessxfFX2qfhtybIj33YFE+7QGEM9ZFPph549GKsQBUqvcFa9RyT9wqf17/hL8ZVdR9/qbaGGyhlBeYVTlp5nyvYa7duEj4NaNIUFyXMVBmMXzSgWA3fJIjPgkswegs0SPyhCz/6HwicFvyt4dNQMvslSLB3PsunUzmY4h0UtoVOd1P189CsFRcZuGQNG/DSgoGH/nK9lPiW5xwVS+Ptedrz8z1oMiU899cLQyWsuIB59re3XZYHkmV3mGj6A4g1Ay33t3Zpta7D2lWlBhIe8JFLQUOW/huRFCz+mXqbkCATm5Fb2W4ImWc4F8bivWVYBXaPB6zLRRoyOlulZVJS7C8wZ3XbKAA87AaEC8RL9//sVIK6VPllssWcupfFyiyuMbimpl0R/3/P02WfIX3M5SG ktzhyXu6 8X7AE2PXxlQBo1auyHp4mv85Hkspx5mNT/JLUCj6GF2JC6sKvRhiMfMyrqcHKzg/ZoHzcAbuIpdjIkuhv7PfN87K93sYSykXYt8Uytek5vbvQSNkXsAIs+Veys+DJQf6OxH5CUlXpgnpahv7xb9bjmow+qYm9Kgbop0PjAR/H9WoBaGLprXQJASGZenlr2pRvUrua8CR7AOFM0Ri5xdqqKCIqIFOIu6U8EV83zLZeLDsh+7HbG1RcJZgo6jCqwjeU5E/13PqbBZmxIJ06OeQSMhfq0XtfN4fbeER/h5RzsyOJOISxHXuhPeb1L7RTIV1RTsst3ovJB3HuPk736YmXwZFNAxy66lFZPgw0g99pjgPtG4Q= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Jun 03, 2024 at 07:06:15PM +0200, Vlastimil Babka wrote: > On 5/31/24 9:14 PM, Kees Cook wrote: > > Introduce CONFIG_SLAB_BUCKETS which provides the infrastructure to > > support separated kmalloc buckets (in the follow kmem_buckets_create() > > patches and future codetag-based separation). Since this will provide > > a mitigation for a very common case of exploits, enable it by default. > > Are you sure? I thought there was a policy that nobody is special enough > to have stuff enabled by default. Is it worth risking Linus shouting? :) I think it's important to have this enabled given how common the exploitation methodology is and how cheap this solution is. Regardless, if you want it "default n", I can change it. > I found this too verbose and tried a different approach, in the end rewrote > everything to verify the idea works. So I'll just link to the result in git: > > https://git.kernel.org/pub/scm/linux/kernel/git/vbabka/linux.git/log/?h=slab-buckets-v4-rewrite > > It's also rebased on slab.git:slab/for-6.11/cleanups with some alloc_hooks() > cleanups that would cause conflicts otherwkse. > > But the crux of that approach is: > > /* > * These macros allow declaring a kmem_buckets * parameter alongside size, which > * can be compiled out with CONFIG_SLAB_BUCKETS=n so that a large number of call > * sites don't have to pass NULL. > */ > #ifdef CONFIG_SLAB_BUCKETS > #define DECL_BUCKET_PARAMS(_size, _b) size_t (_size), kmem_buckets *(_b) > #define PASS_BUCKET_PARAMS(_size, _b) (_size), (_b) > #define PASS_BUCKET_PARAM(_b) (_b) > #else > #define DECL_BUCKET_PARAMS(_size, _b) size_t (_size) > #define PASS_BUCKET_PARAMS(_size, _b) (_size) > #define PASS_BUCKET_PARAM(_b) NULL > #endif > > Then we have declaration e.g. > > void *__kmalloc_node_noprof(DECL_BUCKET_PARAMS(size, b), gfp_t flags, int node) > __assume_kmalloc_alignment __alloc_size(1); > > and the function is called like (from code not using buckets) > return __kmalloc_node_noprof(PASS_BUCKET_PARAMS(size, NULL), flags, node); > > or (from code using buckets) > #define kmem_buckets_alloc(_b, _size, _flags) \ > alloc_hooks(__kmalloc_node_noprof(PASS_BUCKET_PARAMS(_size, _b), _flags, NUMA_NO_NODE)) > > And implementation looks like: > > void *__kmalloc_node_noprof(DECL_BUCKET_PARAMS(size, b), gfp_t flags, int node) > { > return __do_kmalloc_node(size, PASS_BUCKET_PARAM(b), flags, node, _RET_IP_); > } > > The size param is always the first, so the __alloc_size(1) doesn't need tweaking. > size is also used in the macros even if it's never mangled, because it's easy > to pass one param instead of two, but not zero params instead of one, if we want > the ending comma not be part of the macro (which would look awkward). > > Does it look ok to you? Of course names of the macros could be tweaked. Anyway feel > free to use the branch for the followup. Hopefully this way is also compatible with > the planned codetag based followup. This looks really nice, thank you! This is well aligned with the codetag followup, which also needs to have "size" be very easy to find (to the macros can check for compile-time-constant or not). I will go work from your branch... Thanks! -Kees -- Kees Cook