From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB053C54E69 for ; Fri, 15 Mar 2024 10:28:20 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 28A9A80113; Fri, 15 Mar 2024 06:28:20 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 23A96800B4; Fri, 15 Mar 2024 06:28:20 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 102A880113; Fri, 15 Mar 2024 06:28:20 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id F22AA800B4 for ; Fri, 15 Mar 2024 06:28:19 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id BD96DA0CBE for ; Fri, 15 Mar 2024 10:28:19 +0000 (UTC) X-FDA: 81898898718.19.0C6A4CC Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by imf25.hostedemail.com (Postfix) with ESMTP id 16F29A0026 for ; Fri, 15 Mar 2024 10:28:15 +0000 (UTC) Authentication-Results: imf25.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf25.hostedemail.com: domain of gongruiqi@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=gongruiqi@huaweicloud.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1710498498; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VfITtFxJ/6p/ZaVujJNR2/gq3l4jn9NIDB1mbwMiHSA=; b=cE+nRu6yIXBlXSpGh4DCoqA0bVOJf/bwpImwb6XzGorhuWtmDSzmos7jMWOiNZrMD8eYHx FEGXAr7Owf5fzSxKC49gsG/btmVs4reWK/w0bNNPFP8VKRyoLNX5JoCyW2Jgx/zm7I/gnY 15Oq5qDo56Fsq/5gWdeL+GCXpK49zZY= ARC-Authentication-Results: i=1; imf25.hostedemail.com; dkim=none; dmarc=none; spf=pass (imf25.hostedemail.com: domain of gongruiqi@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=gongruiqi@huaweicloud.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1710498498; a=rsa-sha256; cv=none; b=QBRoytVJL0qMYIx3ZVNSFoLUKX6Te/BXqhcCB8GAfgY4J32rRp37iQNQRKKHEiqh/Rw1mB kHmejYezCTYfPMqwCrtZBB1b5PIvQZXAlNJskuUWFykUX5USKzlVKc6UsLFGicQh0kjarL a8OkkwOb96Tf0EQFLE1d0G1Z8n/HQLM= Received: from mail.maildlp.com (unknown [172.19.93.142]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4Tx0nT3dKYz4f3lWF for ; Fri, 15 Mar 2024 18:27:57 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id 45E9F1A0172 for ; Fri, 15 Mar 2024 18:28:05 +0800 (CST) Received: from [10.67.110.48] (unknown [10.67.110.48]) by APP1 (Coremail) with SMTP id cCh0CgCHoguxIvRlMGMUHA--.35833S2; Fri, 15 Mar 2024 18:28:05 +0800 (CST) Message-ID: <65f4c948-06fd-4c15-b9b8-0c8d23568e13@huaweicloud.com> Date: Fri, 15 Mar 2024 18:28:01 +0800 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 0/9] slab: Introduce dedicated bucket allocator Content-Language: en-US To: Kees Cook Cc: Vlastimil Babka , Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Jann Horn , Matteo Rizzo , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org References: <20240305100933.it.923-kees@kernel.org> <202403071227.D29DE5F8C4@keescook> From: "GONG, Ruiqi" In-Reply-To: <202403071227.D29DE5F8C4@keescook> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-CM-TRANSID:cCh0CgCHoguxIvRlMGMUHA--.35833S2 X-Coremail-Antispam: 1UD129KBjvJXoWxXryxCF1UJFW5tr4xWF15Jwb_yoW5Aw17pr WrXF92ya1UJr1UAFyvvw18Wr1F9a1SgF45J3s0gw1rZrnIyw1Ivr1jy343ZF97CryDta1U XrWqy3Wfuwn8AaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkjb4IE77IF4wAFF20E14v26ryj6rWUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Xr0_Ar1l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I 0E14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40E x7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x 0Yz7v_Jr0_Gr1lF7xvr2IY64vIr41lFIxGxcIEc7CjxVA2Y2ka0xkIwI1l42xK82IYc2Ij 64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x 8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r4a6rW5MIIYrxkI7VAKI48JMIIF0xvE 2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42 xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIE c7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07UZ18PUUUUU= X-CM-SenderInfo: pjrqw2pxltxq5kxd4v5lfo033gof0z/ X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 16F29A0026 X-Stat-Signature: r66wkoc4z57tnug9wzf1fuuymxswr888 X-Rspam-User: X-HE-Tag: 1710498495-172268 X-HE-Meta: U2FsdGVkX1+kAZ20nJ2ztQ2w5LzGRLIs5kSpZBoI6v1iMa7XroYMdHNbDYl1MH+5NXANIIgxF7RNuKXI46LoWRnEzK/j/dnwTjR0/7meE6+s2OhYKse7AP0ERxpQLPLaXplYKyDdGQqT/GKGpxel/JNj6d/RjcRev90E7qLQqeg2qSv2jGTXkzEFp8sRaqpDq4mz04m7pTeGXQKwRDPuMkM6G7ckNkgN6appDv31N87JzECYOFSRgEYulbzpi46RNBtIa50JhyRtWIPrueCuVv6OTgPHEU179L71+8Sf5Z7Z2vDANWNrnHM9fdmInQyxERURcWSqTBlcTYK9xzmBcL1BDRJHvqJJZVzlj2i+SYHkwzHbzWFEJqm9Ybkh2dJOoWR4Kjrqi2m513Q6TLyX15glZUqpTrSH4gTANF3L0ML/XGjRfVYB2INPGYSLluZOg6Z5cxocwypGI2ki7dsBjzQGHLnogQuRU5NHMYuOdjuO1knaXoE0sdaOT4QQoh24gXX8rzscFfSgAV4GzeQKCegizLmUROxtAPgPOkL8rC0FEEMDIsWhLctmVMqFCzD7plDoqDlAy5msCLxlOjKP+s5RnXNF4ZSR96dBe2UH4BqsgMMqZyzCeErIHsnhW0x4GU0e0c1EIGkd6NRgEfeOY0bqMNNz+VGKkpMWRPVdFjTNKYETYATnFa3RwRTzgUSaI7yzZCRqUUyKtMjDUzw9znfyorIcg3KqL+vq7oNLmNZNsNFTbtxt21frVxlcXS1jHP7Xhto3bYzXOHm0gIu8rnnjNssN6x1mBtDgrR+9MBEtuV4DUVdoxJp1qS1gQYC8RhG5XiZPGgprmPxp47ZW84wYu9Vy2/gTUniFNCsI5pDOEH6pZs9gpgFt3AcwhW9K/nWOpuhVOAMbgOPKCHBPzZYRo5iHwFnqpWhNEDL6C1pTbpDGMpqeCy/taadzyGZOEZ9yu9NW3f+LVtelvES 3lt/0vdv jtc3myFgxeT2J4fA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2024/03/08 4:31, Kees Cook wrote: > On Wed, Mar 06, 2024 at 09:47:36AM +0800, GONG, Ruiqi wrote: >> >> >> On 2024/03/05 18:10, Kees Cook wrote: >>> Hi, >>> >>> Repeating the commit logs for patch 4 here: >>> >>> Dedicated caches are available For fixed size allocations via >>> kmem_cache_alloc(), but for dynamically sized allocations there is only >>> the global kmalloc API's set of buckets available. This means it isn't >>> possible to separate specific sets of dynamically sized allocations into >>> a separate collection of caches. >>> >>> This leads to a use-after-free exploitation weakness in the Linux >>> kernel since many heap memory spraying/grooming attacks depend on using >>> userspace-controllable dynamically sized allocations to collide with >>> fixed size allocations that end up in same cache. >>> >>> While CONFIG_RANDOM_KMALLOC_CACHES provides a probabilistic defense >>> against these kinds of "type confusion" attacks, including for fixed >>> same-size heap objects, we can create a complementary deterministic >>> defense for dynamically sized allocations. >>> >>> In order to isolate user-controllable sized allocations from system >>> allocations, introduce kmem_buckets_create(), which behaves like >>> kmem_cache_create(). (The next patch will introduce kmem_buckets_alloc(), >>> which behaves like kmem_cache_alloc().) >> >> So can I say the vision here would be to make all the kernel interfaces >> that handles user space input to use separated caches? Which looks like >> creating a "grey zone" in the middle of kernel space (trusted) and user >> space (untrusted) memory. I've also thought that maybe hardening on the >> "border" could be more efficient and targeted than a mitigation that >> affects globally, e.g. CONFIG_RANDOM_KMALLOC_CACHES. > > I think it ends up having a similar effect, yes. The more copies that > move to memdup_user(), the more coverage is created. The main point is to > just not share caches between different kinds of allocations. The most > abused version of this is the userspace size-controllable allocations, > which this targets. I agree. Currently if we want to fulfill a more strict separation between user-space manageable memory and other memory in kernel space, technically speaking for fixed size allocations we could transform them into using dedicated caches (i.e. kmem_cache_create()), but for dynamic size allocations I don't think of any solution. With the APIs provided by this patch set, we've got something that works. > ... The existing caches (which could still be used for > type confusion attacks when the sizes are sufficiently similar) have a > good chance of being mitigated by CONFIG_RANDOM_KMALLOC_CACHES already, > so this proposed change is just complementary, IMO. Maybe in the future we could require that all user-kernel interfaces that make use of SLAB caches should use either kmem_cache_create() or kmem_buckets_create()? ;) > > -Kees >