From patchwork Fri Sep 15 10:59:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matteo Rizzo X-Patchwork-Id: 13386889 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3E37EE6455 for ; Fri, 15 Sep 2023 11:00:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D30F28D0024; Fri, 15 Sep 2023 07:00:14 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C911E8D0012; Fri, 15 Sep 2023 07:00:14 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A6F728D0024; Fri, 15 Sep 2023 07:00:14 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 872138D0012 for ; Fri, 15 Sep 2023 07:00:14 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 60B6280C0B for ; Fri, 15 Sep 2023 11:00:14 +0000 (UTC) X-FDA: 81238537548.19.188B17A Received: from mail-yb1-f202.google.com (mail-yb1-f202.google.com [209.85.219.202]) by imf27.hostedemail.com (Postfix) with ESMTP id 87E2A40020 for ; Fri, 15 Sep 2023 11:00:12 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=qWvgRoNp; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf27.hostedemail.com: domain of 3OzkEZQsKCOwaOhhScfWnncUccUZS.QcaZWbil-aaYjOQY.cfU@flex--matteorizzo.bounces.google.com designates 209.85.219.202 as permitted sender) smtp.mailfrom=3OzkEZQsKCOwaOhhScfWnncUccUZS.QcaZWbil-aaYjOQY.cfU@flex--matteorizzo.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1694775612; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=C4pEChVXRU6sm004Zu1IJnbwIsY1yXPwkOtMip47RAc=; b=JQduJpgu/5cq5xHmA+cSze4GBqvhvMwe4a+OCf/Ql4/UPM+Xx5WXPc+MZx+Cg9bNsIKTun a2tbtRoYLpUQi2LHG8qljQwq1U9fAjqLDkq9F+vaYVSmD0rFBKGUCykaiTaZY0Il0QZTC7 Yp87FbWr4B1bD7+aIgcwJCENQWKydLg= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=qWvgRoNp; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf27.hostedemail.com: domain of 3OzkEZQsKCOwaOhhScfWnncUccUZS.QcaZWbil-aaYjOQY.cfU@flex--matteorizzo.bounces.google.com designates 209.85.219.202 as permitted sender) smtp.mailfrom=3OzkEZQsKCOwaOhhScfWnncUccUZS.QcaZWbil-aaYjOQY.cfU@flex--matteorizzo.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1694775612; a=rsa-sha256; cv=none; b=Zf3WrIWpmscL1mEz/DzPIttih16r/GtGiA3fpFotVD5K+KcmNGlDqsmhsoDnAMuflYgnT1 p0CkkbQDoCY5yqBeXdry2z/WKpUHmLZlDGNi0iKBoxSjuD7mJpDr0I0lriuYZ4urR2TaqR DG9JprWsuEeXyCzhNbaKWEvuNj5CUys= Received: by mail-yb1-f202.google.com with SMTP id 3f1490d57ef6-d8141d6fbe3so2347319276.3 for ; Fri, 15 Sep 2023 04:00:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1694775612; x=1695380412; darn=kvack.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=C4pEChVXRU6sm004Zu1IJnbwIsY1yXPwkOtMip47RAc=; b=qWvgRoNpJC89SaV0wxdXqCxktYf9Pu6EpkvLU50Jn7lYK/2JAXo2Pbhlmrm2xksHIS fpRctFpxUlHyGczzAuAElO8Sc+ozLxlC2ijOzofeCykQcFlEtP8gdR9gdeeXm+Teoypy z51Ymrd+YgZRAUSNsk+HuLn6MaXSqRhCvoRa+0BSBs9d/70IFxUgb3L14wGwFXILzINO 6XqZfpbjXAgsgOKDN2SOkAy2yPMCiWaqGTaE6O56vXveZpINW73c4ikHO/epY5/pm3ii 2TFak9J3lcjD+qs44s6x4tMbla4NsTR2L4Lew90Nwzn+4yjeRHmFAIDbKDKCLWZtpTX8 BGSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694775612; x=1695380412; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=C4pEChVXRU6sm004Zu1IJnbwIsY1yXPwkOtMip47RAc=; b=gGYYnQz1MXLjmzlYpbQ8LmoG6ZblwnEomk2WbHTCiRCnrWE8g2YSI1RklMmv8N/Q6c X3GzRNLlQjy3JotmakYuOcuX1rFGKdXrP5qfJcew9la3T2paJC4WjZePPG74IwEE6kH8 e7xbqo90Rt9c0AW5GFR/tKQShAaAraKf8cTdJXgjWX94Hs72sNBcBHN1MUj02KZpOII+ ttB45sm2i9nKLMbKkWyAzpHXoe53P/v+CuVGo0PQBXmkyw92r4QLqDl4oT6wMu5wYPYN 2OAcSe8YOIXIKcRYEo4RkyZzh1iByrA0OYEYlFlkrp3oZVbQ61luq5ptxZLptrqvgPdE pkDA== X-Gm-Message-State: AOJu0Yw8NxkdLae5/fOvOMcphmj0MTWCAvosZPdzZqvJag9z7D5swfR5 q7WBLBYSL9xGlyZFgOt1uNuNau4I98Gxg6Vlaw== X-Google-Smtp-Source: AGHT+IHt9z6QcITgpugvtEYL0lGwEogSA+C1s55ADVWGOnuIpG1JocMIlh+GBo6p7lHOr6nsErM2osN2OLhU91MuRQ== X-Received: from mr-cloudtop2.c.googlers.com ([fda3:e722:ac3:cc00:31:98fb:c0a8:2a6]) (user=matteorizzo job=sendgmr) by 2002:a05:6902:118a:b0:d80:183c:92b9 with SMTP id m10-20020a056902118a00b00d80183c92b9mr29633ybu.4.1694775611854; Fri, 15 Sep 2023 04:00:11 -0700 (PDT) Date: Fri, 15 Sep 2023 10:59:32 +0000 In-Reply-To: <20230915105933.495735-1-matteorizzo@google.com> Mime-Version: 1.0 References: <20230915105933.495735-1-matteorizzo@google.com> X-Mailer: git-send-email 2.42.0.459.ge4e396fd5e-goog Message-ID: <20230915105933.495735-14-matteorizzo@google.com> Subject: [RFC PATCH 13/14] mm/slub: sanity-check freepointers From: Matteo Rizzo To: cl@linux.com, penberg@kernel.org, rientjes@google.com, iamjoonsoo.kim@lge.com, akpm@linux-foundation.org, vbabka@suse.cz, roman.gushchin@linux.dev, 42.hyeyoo@gmail.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, corbet@lwn.net, luto@kernel.org, peterz@infradead.org Cc: jannh@google.com, matteorizzo@google.com, evn@google.com, poprdi@google.com, jordyzomer@google.com X-Rspamd-Queue-Id: 87E2A40020 X-Rspam-User: X-Rspamd-Server: rspam02 X-Stat-Signature: f5drpfrf1kp4ppmuytp7xzupkw6gunjz X-HE-Tag: 1694775612-875746 X-HE-Meta: U2FsdGVkX18jUpBh+gHtUVzKfreEwqoCTa9nRWylT9OSVIRJ9AbtYfPU4QiFkT8pl8JOZsedUEN0RS1GARkjTbgkAnbgW0JtnMlmfBiorXQuehGz6N1RGL7SVjwMWwgewJL82ATiD3yNzNrH9TbIubu90aRnOIGJKpLwwxnPifexV7rGP2vHNn5dRPWve01U6HfBqgg83MxJO3qC44wf7pvddQSub+FCSNv/Z/QHroH9yP0SM+r7MMiPww+porBQzZQHdRs/XM+v9Smxr97lyY8YHlMQ0ReRNLOwWje6cbtEHaumS5XAInSDC0g/Fg06q3ihGvACeMB3LVcsa3UOsXQe2z9Rbgvrq9FEm44A8XBeHF8iZCaWCb988FQCvhOp4yfiF4kIwU9/rwZfvpyqVLt4wxnxPX6RwY408xEl2p8KUVJ5abNDzwNZshmKHvlCTTPJMzcrwc/nedKQYuWcyCR9G5x/TvP4Lq0jqICUAIKXC+b/OCGlR3gbojMB2CUkMttedrsPlVhBlXF3YQKecFSoh06AbLlJqPRmvgiwmKpmQH6C5L1Q3GEaSfY3pTzv/XJ7rq4mYgCzoExXsoJMwJXsaqY3k+po0cm6WhVEJ0mx5tILRcnnxOcRbCie4HOLLF7db+8oaai31s+nI6K5vzkYUFB9jwQFS0gOaAW8kO1XjUU6rsrVp4anaeuaCzPeXKgEgYMf5k9CO9Vf9H2FtB0B8l7k9TpD9UzyAYF3AElNi3TFrIerozdAiHyd0OBrqZQlLahJm6D/o7hcdU+Z2Oik2g9NEY3982Tv6UGJrEE0y2S2IxZZAx4ypV1ESPGoFcI5Wow8+163qZ0lsAyUhWvwfpKj7u8bmbPU1zKF2NL/XRWH4VJpWY9yT8+EnsVddpDa/pcEPPrSYEwqp4hHf+1jFPDBmEISmMXJWQQoEq0ru7f7NOzS39vCXj+qey1E24NWfQP0AbCgLx+q9ai KgBFqTS1 5z0jQryuC3dLhcRfqScYvmPD1PKjWbUxI47jUl+27rW/fdLGmhuTSc+m+Gl9I0+Ww0CgYyKVfI0d1mNqXMbC4FqEDjEdv5b6zfUl/gYSr9Lfo3oPiKlgp43FE39r5wGDIeBO7z1E4HQEaP1X4CaYA3CD4c6YKccG1j9+qUxiLxRYQuAmMU02fu0TgWish4b2+wv/RLquMLqe3Kmx91m8fWK6lvYmSjNw2+ike3aMwC0gmnGq6e9grvsGtws3UHPwpwQyyDmJ33VbyJjIiKLTOAsjA/LPs9jlUoS3UY1FO85Yji3BqtJ/CK+doqeLLENOWdVbxU+Oq1TP+rRxCYnAPi8ujopVYwet+L5CtfKwqMwZLTqlk5f3SaBmzZ2bulz9LnG3EIgWiCfpdWooN8NIbqAfgikPlZUCQ2rdBZ6bOwnmkNU2VfoyJQF3gMoOi+Lz70AYmGqlL/o9rvbBbZ5/qVLZTlfAt/G1MSOZZEDfbppRkpKRJgMsjKOVM/ifO9XTutVG2JEcSgCWjdeO1C4hitCa0ZWHw+pj4zfi0kPjC/GZa549cHSfG7rGWIWHz1vsGKFxP3TKC0KFhyWy6UZs4KdEwDJe46sZlYB+p7IQRKvWyMkL7KCMKa6R7w+eyRWSeZ02E4L6DilTZsDPeGwIRvUO0po+swFUSAyIwGpNj8akgvPJ+0PowgINWR09xuKgek7qbmv1Fj9dKt5SunCOp4HCYxQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jann Horn Sanity-check that: - non-NULL freepointers point into the slab - freepointers look plausibly aligned Signed-off-by: Jann Horn Co-developed-by: Matteo Rizzo Signed-off-by: Matteo Rizzo Reviewed-by: Kees Cook --- lib/slub_kunit.c | 4 ++++ mm/slab.h | 8 +++++++ mm/slub.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 69 insertions(+) diff --git a/lib/slub_kunit.c b/lib/slub_kunit.c index d4a3730b08fa..acf8600bd1fd 100644 --- a/lib/slub_kunit.c +++ b/lib/slub_kunit.c @@ -45,6 +45,10 @@ static void test_clobber_zone(struct kunit *test) #ifndef CONFIG_KASAN static void test_next_pointer(struct kunit *test) { + if (IS_ENABLED(CONFIG_SLAB_VIRTUAL)) + kunit_skip(test, + "incompatible with freepointer corruption detection in CONFIG_SLAB_VIRTUAL"); + struct kmem_cache *s = test_kmem_cache_create("TestSlub_next_ptr_free", 64, SLAB_POISON); u8 *p = kmem_cache_alloc(s, GFP_KERNEL); diff --git a/mm/slab.h b/mm/slab.h index 460c802924bd..8d10a011bdf0 100644 --- a/mm/slab.h +++ b/mm/slab.h @@ -79,6 +79,14 @@ struct slab { struct list_head flush_list_elem; + /* + * Not in kmem_cache because it depends on whether the allocation is + * normal order or fallback order. + * an alternative might be to over-allocate virtual memory for + * fallback-order pages. + */ + unsigned long align_mask; + /* Replaces the page lock */ spinlock_t slab_lock; diff --git a/mm/slub.c b/mm/slub.c index 0f7f5bf0b174..57474c8a6569 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -392,6 +392,44 @@ static inline freeptr_t freelist_ptr_encode(const struct kmem_cache *s, return (freeptr_t){.v = encoded}; } +/* + * Does some validation of freelist pointers. Without SLAB_VIRTUAL this is + * currently a no-op. + */ +static inline bool freelist_pointer_corrupted(struct slab *slab, freeptr_t ptr, + void *decoded) +{ +#ifdef CONFIG_SLAB_VIRTUAL + /* + * If the freepointer decodes to 0, use 0 as the slab_base so that + * the check below always passes (0 & slab->align_mask == 0). + */ + unsigned long slab_base = decoded ? (unsigned long)slab_to_virt(slab) + : 0; + + /* + * This verifies that the SLUB freepointer does not point outside the + * slab. Since at that point we can basically do it for free, it also + * checks that the pointer alignment looks vaguely sane. + * However, we probably don't want the cost of a proper division here, + * so instead we just do a cheap check whether the bottom bits that are + * clear in the size are also clear in the pointer. + * So for kmalloc-32, it does a perfect alignment check, but for + * kmalloc-192, it just checks that the pointer is a multiple of 32. + * This should probably be reconsidered - is this a good tradeoff, or + * should that part be thrown out, or do we want a proper accurate + * alignment check (and can we make it work with acceptable performance + * cost compared to the security improvement - probably not)? + */ + return CHECK_DATA_CORRUPTION( + ((unsigned long)decoded & slab->align_mask) != slab_base, + "bad freeptr (encoded %lx, ptr %p, base %lx, mask %lx", + ptr.v, decoded, slab_base, slab->align_mask); +#else + return false; +#endif +} + static inline void *freelist_ptr_decode(const struct kmem_cache *s, freeptr_t ptr, unsigned long ptr_addr, struct slab *slab) @@ -403,6 +441,10 @@ static inline void *freelist_ptr_decode(const struct kmem_cache *s, #else decoded = (void *)ptr.v; #endif + + if (unlikely(freelist_pointer_corrupted(slab, ptr, decoded))) + return NULL; + return decoded; } @@ -2122,6 +2164,21 @@ static struct slab *get_free_slab(struct kmem_cache *s, if (slab == NULL) return NULL; + /* + * Bits that must be equal to start-of-slab address for all + * objects inside the slab. + * For compatibility with pointer tagging (like in HWASAN), this would + * need to clear the pointer tag bits from the mask. + */ + slab->align_mask = ~((PAGE_SIZE << oo_order(oo)) - 1); + + /* + * Object alignment bits (must be zero, which is equal to the bits in + * the start-of-slab address) + */ + if (s->red_left_pad == 0) + slab->align_mask |= (1 << (ffs(s->size) - 1)) - 1; + return slab; }