From patchwork Mon Jul 1 19:13:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13718564 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17F2BC2BD09 for ; Mon, 1 Jul 2024 19:13:24 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 201606B00A1; Mon, 1 Jul 2024 15:13:11 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 099256B00A4; Mon, 1 Jul 2024 15:13:10 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B9C2C6B00A1; Mon, 1 Jul 2024 15:13:10 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 935486B00A0 for ; Mon, 1 Jul 2024 15:13:10 -0400 (EDT) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 4B2FF141D27 for ; Mon, 1 Jul 2024 19:13:10 +0000 (UTC) X-FDA: 82292131740.13.985488D Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf07.hostedemail.com (Postfix) with ESMTP id 7577E40017 for ; Mon, 1 Jul 2024 19:13:08 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=bFl59nSl; spf=pass (imf07.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1719861178; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=UCPqAS1wQfpkxBSq+RkvtyhAWYw0GfCz0eapB+gICZU=; b=mGpxwuhRJeg+h+rIBCSEh45aaklsv+X+g1vW9VSxH5lh0zMZ6BVBb1X935Pn5/v2fzqLa5 2teHfr21KOX5fHqBTyfZCFiiqXgnxoLg8d4Xh6GHFeYJPLZLOZ+/FRVuu1FGpZIND//e9h SEcKrI8Yo+RppqkOg5zls7exCeQ4KRQ= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=bFl59nSl; spf=pass (imf07.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1719861178; a=rsa-sha256; cv=none; b=npWmHilwHaiUS1aCUQ54e+n04UAS9m7hNmeblCcoHdaSmocQqCMC+V6q65QcTYHwMax43V btaArD83X7PweeklYLRPg85KztDzwEmKKrm1oQkI8pArNbr3Eq8n1FVUfxPE4fIexNtxt+ PnRx4541uLabcQkHfc7+CoacIGWjKgQ= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 940206178F; Mon, 1 Jul 2024 19:13:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1EA58C4AF0D; Mon, 1 Jul 2024 19:13:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719861185; bh=BZ80Ejo56zseoiz3weNc0AtXfj9+HOXw5S5R0du1E70=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bFl59nSlnVaSRU4+0HTFQ/YeTaJahbBTt5u256YqqA/IZQs7WUOzBvYKYRUR7Jmb+ wChXJYbVxmTLzNRLpAAdNpOUmpNsdgtdPYaJohsJXrbZU6BCCf7ByLGnDH/BQ216L3 560Mu5RiCeTyUZ/1umQVt9bDpooP1+0DEUxtHU2rZe8fjdKsqR/lSu/h5TyYmL36gl B+EZzQJtEw/HTSqmuDqIJgLCnr4S7c9/dCzAmRxEeHSGjY5ypxgKwo/Qu6ELpXbvlh V1yE6QbOqM4goWOm1jibPASL3Mm/dft5RrFbUr9E7X9HNaKn/bgWcHd4IL6jWnK2Nr qPcQDrAj7jZcw== From: Kees Cook To: Vlastimil Babka Cc: Kees Cook , "GONG, Ruiqi" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , jvoisin , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Xiu Jianfeng , Suren Baghdasaryan , Kent Overstreet , Jann Horn , Matteo Rizzo , Thomas Graf , Herbert Xu , "Gustavo A. R. Silva" , Jonathan Corbet , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH v6 6/6] mm/util: Use dedicated slab buckets for memdup_user() Date: Mon, 1 Jul 2024 12:13:03 -0700 Message-Id: <20240701191304.1283894-6-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240701190152.it.631-kees@kernel.org> References: <20240701190152.it.631-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2796; i=kees@kernel.org; h=from:subject; bh=BZ80Ejo56zseoiz3weNc0AtXfj9+HOXw5S5R0du1E70=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBmgv++lHHVc7IaWVXSWcs6s/+88cmgFNyMQ+/tk NfYGR7ScZKJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZoL/vgAKCRCJcvTf3G3A JqpJD/9rs0Nsc8oYdGcPhljjR3Oz9ava6B9ExnvhV2nq0WD+FJVM5EdnZQAwoNyWeBpcuY2PjdX lGeJh61ZCUx/6o593wAWAgLwf2e/Mhg8nSPBCedp2wVFCHCVtzZhrNBAaQlXjO3gqzsR3DB03kj bchxInUC1Jscc86bOfbjVaIQ5IEy5V7YzHU6nQndBY2UIg+uZZmOkFzlZJpnMapIejOc6SpanQA hV6NVDpX2xdgr7MF4aOqxOwTrZz75rZo/5GXBqomoCrJB/fD4y99gSAraNxMJGvzAIKI8sJVGKr nsL6Q/dH6LCFuZlplSg3SIYt9Gos+RIxGQkllf9g7DUjeUG95w+fsoV1avbkZXjgQnI2mfAyjMF LgFIqrfiAFybNMFQqTOyMz5qVVeFFFi/KS+LDgZLc8yQlhZP519x+tJ6F4oVUtqM4dW5u4yP6Vp DG21pqkK6pZGhWARTM64DaxCBk/pN0rgw4Kuu/yLd29xhS7+fvJkksPam8vLip8OXe83i4Euu0m JTpZvCyJaLkwRmeqjgLa8fTykUMXm3m1HS9xyfPOrqmY9zOiJg6hGNR8aS7wdw+z9wjeph7E6pc z2OqisDHlJ0Pad2aMEfBofKXW2BKrBAxRPKjOnkC7biQAMODdjv2mPwU4BWxkHlSZwtHdrCs+GE Lj0ThhUc9z01RFQ= = X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Server: rspam03 X-Rspam-User: X-Rspamd-Queue-Id: 7577E40017 X-Stat-Signature: 47n149sqjejqze6sfhrip9zbe1ra895s X-HE-Tag: 1719861188-782470 X-HE-Meta: U2FsdGVkX1/jcZo6qsK/t1ZxdPLR46u0sCWtZ4gww5Alg55tjYirPvneycSWqzUGBHCDUQ+9f8vbXWax+xUYaDUcC8S1fddCSta8ztPQP5sd7bXCOUGqPmlIFt5V8bUWdE7M0hO6CtRkP2SdonSoknIE5d+SVtWXCi+Qux5noyGrZYhn6Ytg38JjWmVeHMbsf8AwzL9UpYXhcF4pNng9efWa4VcVH/mMSti6499wBvw+GizOiKqPcWLWLVkk5imh9gBjX6WTF9Hf8ZLvComzwnnnY59sKf3IAdqmhgaTBSGbfDuYg3vs6nwmwte77ra3QSFwo3o/3KKgiA/Fo+5ezydhplo8a14lT7IIH9N8+/G3wxquTmfNkXUZUXpKzkRTsVyHhhmFIVRU05UglVEa7CkunnDtCH88urQplH3SUPHBnEqY0yjRrk1VxuqqcvMWOp3fQumuzQKEDs94VZSfyU7rimsbqVV8VB4FsKRgN6sccPviMtmWElEltz20u1pghbsJgC91JTAff98P8KTmxdz9rVimcO6q1SXQgt8hrEYqG24I+ECTvNovdVe7na4wm8Sqz5nIDKaAHuAV5bfnYWaAWN4B94x2VY4ekHR735pr9PqFNDyJVbqz3MYZk2xDo7q45YRaor+fLdGcvURoZhI0l9d3XoAeD59o/JlVjOsZEs6PykZ5QyyGNPVFwJBCnOnucWAhjg0O/E3I6UFl6NZhotg+8qjXi9i8OKgLCXc/uZxyCWqZWzrFoPdpWE49wGw20d8AHUDZOBpNjVUc61aNJ/NAEWYeCReyIQLCLq1yfSkqdCsIxb1Jq2d5KbfhqFRYO4GrgUpYIlTZdFr9pzJ673p4Hrw96R9jj3NpRYPR+pCeQO+lqzoQAVuIRZKjbJ4c3663M71w3BuFOUwKFvqH14VMvtr0JzGZj5gk1FYGB5fslO57o50Xz00vRbYacfbekmpXXqH2y55QOEZ 0s9tlYUf qZy1y68aNR7fzVLxJy4vXtFyZGNG/mGR685XZ+U7CIH1/EtT8XT9us5WLT7FM+VQ4o9XKBSfIsm81JMuiHl6QUxJ7JcahxaywQDh9b2i9mB33CVmkI+TkHoyGvXBFLQUwza9GQCiFC/klclyoLw/tKE1DHrtlZKFgSQxv+LNlMDhgaYHRZZklErqwjQcpsVYv7M/FhxEOQtSstWa4w1aV/8EjqG9f/q47v9NWCZnEMQO2XUM5jIVraUyHBGW7XHBbNZBv1NtqnMe04eAjFc075SSekaBrSi9AnSYf575SNIwICyD3VBoNgNaJ88pJfLPMQimXkYf9BMCRLPsUnGnvhYBwW99W5SZtilnPRPSzOU/U4xKcqdNCeeG4F6FV5n4KjxCUwZDGL1gTWZRlMcxCEhovKHgIPF9n2boEb/kvvEtI8pYinxkhGb4JTautQc8El28Is3ws+gbFHs+0OnqAHQfAo2Q7ePiUmnhKhgadr4IND4jNRfp9HRgbQi7OyYceLtYj7usHBbmXqX5Pf9/l6sTgJFx5Q3MkOHc2D6LKOvtS5AGlDavMNPTcQxvcUUkvyoQ05NO5toOkKypGLzNfJ/SXAvCOzLYGSuyz X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Both memdup_user() and vmemdup_user() handle allocations that are regularly used for exploiting use-after-free type confusion flaws in the kernel (e.g. prctl() PR_SET_VMA_ANON_NAME[1] and setxattr[2][3][4] respectively). Since both are designed for contents coming from userspace, it allows for userspace-controlled allocation sizes. Use a dedicated set of kmalloc buckets so these allocations do not share caches with the global kmalloc buckets. After a fresh boot under Ubuntu 23.10, we can see the caches are already in active use: # grep ^memdup /proc/slabinfo memdup_user-8k 4 4 8192 4 8 : ... memdup_user-4k 8 8 4096 8 8 : ... memdup_user-2k 16 16 2048 16 8 : ... memdup_user-1k 0 0 1024 16 4 : ... memdup_user-512 0 0 512 16 2 : ... memdup_user-256 0 0 256 16 1 : ... memdup_user-128 0 0 128 32 1 : ... memdup_user-64 256 256 64 64 1 : ... memdup_user-32 512 512 32 128 1 : ... memdup_user-16 1024 1024 16 256 1 : ... memdup_user-8 2048 2048 8 512 1 : ... memdup_user-192 0 0 192 21 1 : ... memdup_user-96 168 168 96 42 1 : ... Link: https://starlabs.sg/blog/2023/07-prctl-anon_vma_name-an-amusing-heap-spray/ [1] Link: https://duasynt.com/blog/linux-kernel-heap-spray [2] Link: https://etenal.me/archives/1336 [3] Link: https://github.com/a13xp0p0v/kernel-hack-drill/blob/master/drill_exploit_uaf.c [4] Signed-off-by: Kees Cook --- mm/util.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/util.c b/mm/util.c index 28c5356b9f1c..29189f48ee04 100644 --- a/mm/util.c +++ b/mm/util.c @@ -198,6 +198,16 @@ char *kmemdup_nul(const char *s, size_t len, gfp_t gfp) } EXPORT_SYMBOL(kmemdup_nul); +static kmem_buckets *user_buckets __ro_after_init; + +static int __init init_user_buckets(void) +{ + user_buckets = kmem_buckets_create("memdup_user", 0, 0, INT_MAX, NULL); + + return 0; +} +subsys_initcall(init_user_buckets); + /** * memdup_user - duplicate memory region from user space * @@ -211,7 +221,7 @@ void *memdup_user(const void __user *src, size_t len) { void *p; - p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN); + p = kmem_buckets_alloc_track_caller(user_buckets, len, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM); @@ -237,7 +247,7 @@ void *vmemdup_user(const void __user *src, size_t len) { void *p; - p = kvmalloc(len, GFP_USER); + p = kmem_buckets_valloc(user_buckets, len, GFP_USER); if (!p) return ERR_PTR(-ENOMEM);