From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C562C54798 for ; Wed, 6 Mar 2024 01:48:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 465196B0074; Tue, 5 Mar 2024 20:48:05 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 4167D6B007E; Tue, 5 Mar 2024 20:48:05 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 304856B0080; Tue, 5 Mar 2024 20:48:05 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 1BCD76B007E for ; Tue, 5 Mar 2024 20:48:05 -0500 (EST) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id E0278A066A for ; Wed, 6 Mar 2024 01:48:04 +0000 (UTC) X-FDA: 81864928488.23.007AE38 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) by imf03.hostedemail.com (Postfix) with ESMTP id 5963720004 for ; Wed, 6 Mar 2024 01:47:59 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=none; spf=none (imf03.hostedemail.com: domain of gongruiqi@huaweicloud.com has no SPF policy when checking 45.249.212.56) smtp.mailfrom=gongruiqi@huaweicloud.com; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709689681; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aUOuZzzGWE8d/fiDJAIy+KwU6rrzptCFkLlb+awkHyQ=; b=0W08GEPdf+0vO9ljuQVr9+UzWsyFCwSWxrVgxyWW06xWfX/Ec/Tjiyd0Pe/wpM+2ElSMgz F9toSkc70KECA9QqxAaBAAdYqgAc8bnfC1+zof2wDPuw+SdBpJ456Dp68+YOsDOOVup3bt NkV5AFgj0Ud+5+pLv/8XqvQtTNOP+jA= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709689681; a=rsa-sha256; cv=none; b=LvNbNB4yk1+7y/bQvz+S3wrZl6Xvu802tueR9EYZkJrdEkFt3vvc+u26PwMMp25UHKpqfV zoWJ4fa/RhhcuVPFDjYDmsdYWwuvJiEG1/44Hb4d8x1k7WINMkCNVn/rnV1KaQ/lpNq65N lEKKJLyQiRhNX+87ZY1nmCitRlwjOoY= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=none; spf=none (imf03.hostedemail.com: domain of gongruiqi@huaweicloud.com has no SPF policy when checking 45.249.212.56) smtp.mailfrom=gongruiqi@huaweicloud.com; dmarc=none Received: from mail.maildlp.com (unknown [172.19.93.142]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTP id 4TqFgT2Dxqz4f3kFY for ; Wed, 6 Mar 2024 09:47:49 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id B94EF1A0172 for ; Wed, 6 Mar 2024 09:47:54 +0800 (CST) Received: from [10.67.110.48] (unknown [10.67.110.48]) by APP4 (Coremail) with SMTP id gCh0CgBXqGo3y+dl7_isGA--.28780S2; Wed, 06 Mar 2024 09:47:54 +0800 (CST) Message-ID: Date: Wed, 6 Mar 2024 09:47:36 +0800 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 0/9] slab: Introduce dedicated bucket allocator Content-Language: en-US To: Kees Cook , Vlastimil Babka Cc: Andrew Morton , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Jann Horn , Matteo Rizzo , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org References: <20240305100933.it.923-kees@kernel.org> From: "GONG, Ruiqi" In-Reply-To: <20240305100933.it.923-kees@kernel.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-CM-TRANSID:gCh0CgBXqGo3y+dl7_isGA--.28780S2 X-Coremail-Antispam: 1UD129KBjvJXoW7Zry3Xr4rGw18uFyxZw4rAFb_yoW8WFyxpF Z5XryIya1UJr17Aa4kZw18Wr1F9a1xGF45G390gw1rZrnxA3Z29r1jy3y3ZFWfCryDt3WU Xryq9w1S9wn8AaUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUk0b4IE77IF4wAFF20E14v26ryj6rWUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x 0267AKxVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG 6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFV Cjc4AY6r1j6r4UM4x0Y48IcVAKI48JM4IIrI8v6xkF7I0E8cxan2IY04v7MxAIw28IcxkI 7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxV Cjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVW8ZVWrXwCIc40Y0x0EwIxGrwCI42IY 6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6x AIw20EY4v20xvaj40_WFyUJVCq3wCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv 6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjxUFDGOUUUUU X-CM-SenderInfo: pjrqw2pxltxq5kxd4v5lfo033gof0z/ X-Stat-Signature: x1pdsoes5xwt8de45c6eykdheh5qq4yq X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 5963720004 X-Rspam-User: X-HE-Tag: 1709689679-409419 X-HE-Meta: U2FsdGVkX192q+u8jMB6s3b1cyHTo9AHTGsp6+/CAEUUwgd/if4iL8lWtWktpqegJ2WKnObqGgpq1mPO/cWmbtfVZMuvAfPclttAnc3V0hjFMlspEkDdWUtM3etaxY0oN40i0vJYi8OMsvW2ZM031UpfTDkZSJR9dfeIeYhD/kzZSS211Z/TI2muDW2cfOn8AxvaBqUpMtEpbyY4kYqUyQoVNjx7APKiDyWzrdlp2+QINRph+evTqe2unlsLaXwUkm/21ay5JIeBsBr6VPw7TYP9iztarjhXJtFt6De2XlsqGUylQ0qofYyVg+9rWXWii/9nnQwMTnGfKXM7brGElMmDaUSTRTg4iTaccPpATDziAI+OWbdmjgRV4XnOyvwNzbVyuy/Zsj0ZxdonDYJcfi+KBz+VcumeMHeFuY/f9VmJu6N6Xtknq5nFhQ3WxmLXajWT7PS8mojGWSnRf4z12WRkoXWsIV6sJx6kEWXOKYWCHrnZLRUKcRz5+mHMzdbG0VKiR84oQwZCfvzbUolMt8K4qmFhwP3e6ma+q9pbIx/MjMv4GrRNAYoGU7fnPOACavg3833KvoB+OClg1N4gagkvXbYVirKkEBbRq40/KNiG0DddQumqIBWaxiBlDBiY9p4dJ1Oy1M890QNh79sA0oMqNqVC6yz0VAABOh8kqKqmfyitn6afKkQAG7CFCWmNYgUWY497eW8dZ7dcIqdcSCzmZa25z88UjX1cd2ppJ7o/krQ2t6ne97++DI8a504M0+dvhuKw9PaD5KsxFGuiDnLEje2TAL8eI78+SFRwqN7JJhwty+detwmQd/B+nev3kSUfTn/pGjV4qEwbekDVXaiRJrMM8CpsZwxEyrwRvgs3SQidjCinfvobbqOBaaH/HSYnv3SLWdE8Pj+95CqOex1N6kmsRuO7J0zLmqNuvGKK0BrgVRPciyjH+YhnRmL6uoFqTFTYBR9lZF0Jnl6 /utO/JXN ZCOukxjiaRJOMT26QUMyLBVrvIHRJ8F1tvfVnuUqf3v13Py8rer0HMeBcc0RJlILJgcGeBQREDzWyaPj/0+QYSs+ej48oSaWzMPh6snczzWfwAYX+9RRQjhzGVNY+WffpIrUo9qtNo9Hr965CeNljzeieVmEY/uLz9W8K+H8CniC7LGP1REL1SahrGVXKhoK57rot29U2aoomU1y+xZAZY0Ak5epn5VlM+ZTB/OHZmqhKZodqbgvFjzfiIg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2024/03/05 18:10, Kees Cook wrote: > Hi, > > Repeating the commit logs for patch 4 here: > > Dedicated caches are available For fixed size allocations via > kmem_cache_alloc(), but for dynamically sized allocations there is only > the global kmalloc API's set of buckets available. This means it isn't > possible to separate specific sets of dynamically sized allocations into > a separate collection of caches. > > This leads to a use-after-free exploitation weakness in the Linux > kernel since many heap memory spraying/grooming attacks depend on using > userspace-controllable dynamically sized allocations to collide with > fixed size allocations that end up in same cache. > > While CONFIG_RANDOM_KMALLOC_CACHES provides a probabilistic defense > against these kinds of "type confusion" attacks, including for fixed > same-size heap objects, we can create a complementary deterministic > defense for dynamically sized allocations. > > In order to isolate user-controllable sized allocations from system > allocations, introduce kmem_buckets_create(), which behaves like > kmem_cache_create(). (The next patch will introduce kmem_buckets_alloc(), > which behaves like kmem_cache_alloc().) So can I say the vision here would be to make all the kernel interfaces that handles user space input to use separated caches? Which looks like creating a "grey zone" in the middle of kernel space (trusted) and user space (untrusted) memory. I've also thought that maybe hardening on the "border" could be more efficient and targeted than a mitigation that affects globally, e.g. CONFIG_RANDOM_KMALLOC_CACHES.