From patchwork Tue Apr 15 17:02:33 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 14052463 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A93BCC369AB for ; Tue, 15 Apr 2025 17:02:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D14B32800B9; Tue, 15 Apr 2025 13:02:42 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C9A8D2800AF; Tue, 15 Apr 2025 13:02:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AEE152800B9; Tue, 15 Apr 2025 13:02:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 8FD3C2800AF for ; Tue, 15 Apr 2025 13:02:42 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 8E19ABC01C for ; Tue, 15 Apr 2025 17:02:43 +0000 (UTC) X-FDA: 83336897406.30.AFBED32 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf29.hostedemail.com (Postfix) with ESMTP id C2BE6120022 for ; Tue, 15 Apr 2025 17:02:41 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=aXkf72fz; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf29.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1744736561; a=rsa-sha256; cv=none; b=8cWaXEkvGsYzNlOEKM/bQ/+V5NIHCThQIzD+2H9+jL/vADDqGVp9RFgFv4eGUxNLlo8AEl K+y7hqV7MwUT+g2ULWU2wuJlgI9sr8LcBJICKhU/+FbELfWKjrd/Th/6OE/Qr7EZ/qfWtT urErSnpjv3ahdsydZWmmXvuVjdiGyts= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=aXkf72fz; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf29.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1744736561; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=g+9Iywh9FDHFvupnNaTTeADP9F98QdQJc7PWrRqEpi8=; b=0Ubk8w29uD3qUFQzUQkiKdP61cPtcNSSVmrD+cL2qp41MZ6mXMbhZ6nMBtSGwRk1m7HSp5 ztR3h8qOSa7fmhOqVl3amABDGR9zvrHiHWh+ZisprNPQckO0CcS0WDG9oDEG0rP1wEW1Af IFkpNe+BgIUUqi2dXdBThQioS0TA958= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 9F5175C5915; Tue, 15 Apr 2025 17:00:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 453E8C4CEE9; Tue, 15 Apr 2025 17:02:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1744736560; bh=WgJ7ltnjSlSMgyEg86kq1HUblr9Q7ZvJJzZDcJ6BoSs=; h=From:To:Cc:Subject:Date:From; b=aXkf72fzanAJsg1tKVDIKR5oeSoWjGYAT3dwSOH/JYFxk46G3M7QLa/Po/VHaPuVf jVyA2ev+hQPbYzYeJwMmOVNG1+lEn25otvldn1S3nf5a/yTQEfesvZr4u/P1PJM6/X XGGM68DhVw/K8+r4mi/qXNxUUcTBr5CZH/dVMjXqXf8eBbhdrg0E5cA3G7Eg5GeRNJ UEld3Tv6AfJjVMf/7/1GyJ/SS1hSd1q4xX8I7bBcr5QbIwlsjzFszfjjEw+5syRWRn PtpwQ/Hwf/UcdwaT4fnGlptyfiusO34vzPOr+Rub0Up77tMCiCMJ/5GVLlTWDiNiTC 2L6ODMxSxnqfg== From: Kees Cook To: Petr Mladek Cc: Kees Cook , Sergio Perez Gonzalez , Vlastimil Babka , David Rientjes , Bagas Sanjaya , Jonathan Corbet , Steven Rostedt , Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Andrew Morton , Christoph Lameter , Pekka Enberg , Joonsoo Kim , Roman Gushchin , Harry Yoo , "Paul E. McKenney" , Randy Dunlap , Tamir Duberstein , Miguel Ojeda , Alice Ryhl , linux-doc@vger.kernel.org, linux-mm@kvack.org, Thomas Huth , "Borislav Petkov (AMD)" , Ard Biesheuvel , Greg Kroah-Hartman , Andreas Hindborg , Stephen Boyd , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2] slab: Decouple slab_debug and no_hash_pointers Date: Tue, 15 Apr 2025 10:02:33 -0700 Message-Id: <20250415170232.it.467-kees@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=8813; i=kees@kernel.org; h=from:subject:message-id; bh=WgJ7ltnjSlSMgyEg86kq1HUblr9Q7ZvJJzZDcJ6BoSs=; b=owGbwMvMwCVmps19z/KJym7G02pJDOn/Jmq+ZbwuMbkjfWHjYlP5D83ix8+1eF1imXlq9/eez 7aLzjiJdJSyMIhxMciKKbIE2bnHuXi8bQ93n6sIM4eVCWQIAxenAExEs42R4dhRDe6V+pfadUsz /1s4uGXl2wkUnZD+Lmee+VLU7948N4Y/nC4zCjS27Pp9Je7qrq4ds85u2bWVZcf1j9MZ/PemaCV qcAIA X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Queue-Id: C2BE6120022 X-Rspam-User: X-Rspamd-Server: rspam07 X-Stat-Signature: z6qw6kg9sq47ciirbf1nqs9q4ocehqu9 X-HE-Tag: 1744736561-766381 X-HE-Meta: U2FsdGVkX19Lxa7GAUjPs8srYID8p0CM7xGgYHtQyXULV1ZdSuO7dia/AJK/+m1UvYHKJKN6sRdkBmyQv7O4RtFZcsphDTvIojm3xBfhP6nDEN1yQQRfeKih7VQMhCcc+SgLVEX52fqgtWKp3tKvSRkzwPicx4TjGNXjQc9h66if1RJ9p5qjwPfhZA0Gq3cmybOV5ObkX8Iw/kAfI6r6gag3o3EjJtHp8IIjt+XQog1tSvHQzMIGRsl6SooFSc/gYrihIHktrqyZ218UQ7voKbmOa/4S/0r1d7d3SfqxYvsIea+ZfUBPB1HsDd3tbAGs1PIIbI6xr1jSahS8loqG6yC1XCmVdp/x/HYqvp+Da8QbKet4udKOUapxE1/XXqrYSQiVn3cbeUWIiUTXBFIRsvtwZqnoT2nEnfwNQz4fPn3Y27outLFhlklKDU7fU/z7s1fTemTpVyHLKhpr3ChwpmXaj0/ZlmwjhUIsMAgK99FTbAsGy+zwonmdpUSEJ9Ijm7gnNpW35mimuwNVKwVx/VRfo9xl/rUIfJZ36ymiVN7tJ4KcBuOLJMqYmv1TU07AZU6hgUVKv0qIkjkFT/+/dQi1fvCbkIqX68y+c/GOvqoL4Pxi9t9hvM/tWZmOEXk2trZJbX7UL5SukUpRkOiF0Iui5WW2cnc38+GfcOYe4Hs1XUPWGmWlsf4a+DoVGIGcDVZqx8z/VXSu3yzKC+0KTpL1cYK+RYnsN+ErgqZl0eRIqqpCFksRXrZmAxXoLa/E4E8HbMQ4LprpT9QH03McqadWj7s94pSM07AY8hn7ndgaWdwEe/3eTZBNOM9zQPkMJ1umlQNxcr7cezM6CzYtz+1qcnaKqpmd3MSDF3N38aRL0oWMYhtEWEY2ID9/HVHulGynM7atVp97WKiOsFDsw7PWAPFUbXwT0hvy3R5zhmdh5NOlZq8NtMQWiUg2gG1XbfM3RH8yXrA5WBVeW2S 2ZPZtdt0 yRZo2l4hgB2jyDLZYU/LYvkSvXIg/6OXIqfoVwLHjKsXDgpESnp8fFra0htW3L0T6iUKzyM+05Xc6hYJ6SFmt8mQbbVWSPsa3O+7aJgAKmyGu9emigZDZeBjoidsz+Pd8DiIRb6OBgyGyWoSDm8FC4CzbjDr8t6vJbAYEB1b7JK4fPN/N1hRFbyl+vsIR6pDF6n63NtxisGmo0WJ9QJYG8Tf2jKS+hIfz6DamPxzZPAoe9efqDZ4PH5sUpNZawaIL0Gspb4Xw3IkxWO6JkICvzqCFMMu7D0t+RD52Kd9FRklEC+B/TDeJrhmFt4fl3DtRwLm/z4W5a74iv9LM2h9F+0/xN1Dqo5t5x5Zm8ZKztMpa/sgjb4kRjunZA7ZPg9ZzCpaXxwQjUTxlYFbGj8GxnhxdduwzRanC84gTs2hFx4OeKQCCbNRciVXyp5kY9hGlIa6cJujYnzOtq3gifzC+bx7VvEbUdS/ekiw3OIyWul+xTySXOkiXPUb4IGoUFqFu3vn8fMeU2hPi/YReCvitlB/BuF1yElC/1MCJnxXwyOiYAUFRgc24FZb2dDUoNIGH9OWuQe0vQx53xexAJCHaWWwFbT1euJhZUYGaf453mfVDOjEhpXBgDTGgPrEmyMZIs1p271e6IPy7UjuM4BWQtpo5/0iDtOWxTq8JosoRE1r5N8HpDBdzLb9twMuJW91wOak4u5IZ09ItTwJRPq4zf7d2ExykzVjhRQ5kZqdbkZvQTx8N9Qh/ibNp7qjls2Eyh9rC3Zd02/3UU8NGJ6C0Eyq9sD+t+W4zB7atXHVZB3AKbL3JrtagW1ZWrsN1BF2xHoQLRQWucgxmFWOwU76/uhI6Tbti2fH40NVZ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Some system owners use slab_debug=FPZ (or similar) as a hardening option, but do not want to be forced into having kernel addresses exposed due to the implicit "no_hash_pointers" boot param setting.[1] Introduce the "hash_pointers" boot param, which defaults to "auto" (the current behavior), but also includes "always" (forcing on hashing even when "slab_debug=..." is defined), and "never". The existing "no_hash_pointers" boot param becomes an alias for "hash_pointers=never". This makes it possible to boot with "slab_debug=FPZ hash_pointers=always". Link: https://github.com/KSPP/linux/issues/368 [1] Fixes: 792702911f58 ("slub: force on no_hash_pointers when slub_debug is enabled") Co-developed-by: Sergio Perez Gonzalez Signed-off-by: Sergio Perez Gonzalez Acked-by: Vlastimil Babka Acked-by: David Rientjes Reviewed-by: Bagas Sanjaya Signed-off-by: Kees Cook Tested-by: Petr Mladek Reviewed-by: Petr Mladek --- v2: use switch state to avoid missing states (pmladek) v1: https://lore.kernel.org/lkml/20250410174428.work.488-kees@kernel.org/ Cc: Petr Mladek Cc: Vlastimil Babka Cc: Jonathan Corbet Cc: Steven Rostedt Cc: Andy Shevchenko Cc: Rasmus Villemoes Cc: Sergey Senozhatsky Cc: Andrew Morton Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Roman Gushchin Cc: Harry Yoo Cc: "Paul E. McKenney" Cc: Randy Dunlap Cc: Tamir Duberstein Cc: Miguel Ojeda Cc: Alice Ryhl Cc: linux-doc@vger.kernel.org Cc: linux-mm@kvack.org --- .../admin-guide/kernel-parameters.txt | 34 +++++++---- include/linux/sprintf.h | 2 +- lib/vsprintf.c | 61 +++++++++++++++++-- mm/slub.c | 5 +- 4 files changed, 82 insertions(+), 20 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 76e538c77e31..d0fd9c745db9 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -1798,6 +1798,27 @@ backtraces on all cpus. Format: 0 | 1 + hash_pointers= + [KNL,EARLY] + By default, when pointers are printed to the console + or buffers via the %p format string, that pointer is + "hashed", i.e. obscured by hashing the pointer value. + This is a security feature that hides actual kernel + addresses from unprivileged users, but it also makes + debugging the kernel more difficult since unequal + pointers can no longer be compared. The choices are: + Format: { auto | always | never } + Default: auto + + auto - Hash pointers unless slab_debug is enabled. + always - Always hash pointers (even if slab_debug is + enabled). + never - Never hash pointers. This option should only + be specified when debugging the kernel. Do + not use on production kernels. The boot + param "no_hash_pointers" is an alias for + this mode. + hashdist= [KNL,NUMA] Large hashes allocated during boot are distributed across NUMA nodes. Defaults on for 64-bit NUMA, off otherwise. @@ -4120,18 +4141,7 @@ no_hash_pointers [KNL,EARLY] - Force pointers printed to the console or buffers to be - unhashed. By default, when a pointer is printed via %p - format string, that pointer is "hashed", i.e. obscured - by hashing the pointer value. This is a security feature - that hides actual kernel addresses from unprivileged - users, but it also makes debugging the kernel more - difficult since unequal pointers can no longer be - compared. However, if this command-line option is - specified, then all normal pointers will have their true - value printed. This option should only be specified when - debugging the kernel. Please do not use on production - kernels. + Alias for "hash_pointers=never". nohibernate [HIBERNATION] Disable hibernation and resume. diff --git a/include/linux/sprintf.h b/include/linux/sprintf.h index 51cab2def9ec..521bb2cd2648 100644 --- a/include/linux/sprintf.h +++ b/include/linux/sprintf.h @@ -22,7 +22,7 @@ __scanf(2, 0) int vsscanf(const char *, const char *, va_list); /* These are for specific cases, do not use without real need */ extern bool no_hash_pointers; -int no_hash_pointers_enable(char *str); +void hash_pointers_finalize(bool slub_debug); /* Used for Rust formatting ('%pA') */ char *rust_fmt_argument(char *buf, char *end, const void *ptr); diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 01699852f30c..22cbd75266ef 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -60,6 +60,20 @@ bool no_hash_pointers __ro_after_init; EXPORT_SYMBOL_GPL(no_hash_pointers); +/* + * Hashed pointers policy selected by "hash_pointers=..." boot param + * + * `auto` - Hashed pointers enabled unless disabled by slub_debug_enabled=true + * `always` - Hashed pointers enabled unconditionally + * `never` - Hashed pointers disabled unconditionally + */ +enum hash_pointers_policy { + HASH_PTR_AUTO = 0, + HASH_PTR_ALWAYS, + HASH_PTR_NEVER +}; +static enum hash_pointers_policy hash_pointers_mode __initdata; + noinline static unsigned long long simple_strntoull(const char *startp, char **endp, unsigned int base, size_t max_chars) { @@ -2271,12 +2285,23 @@ char *resource_or_range(const char *fmt, char *buf, char *end, void *ptr, return resource_string(buf, end, ptr, spec, fmt); } -int __init no_hash_pointers_enable(char *str) +void __init hash_pointers_finalize(bool slub_debug) { - if (no_hash_pointers) - return 0; + switch (hash_pointers_mode) { + case HASH_PTR_ALWAYS: + no_hash_pointers = false; + break; + case HASH_PTR_NEVER: + no_hash_pointers = true; + break; + case HASH_PTR_AUTO: + default: + no_hash_pointers = slub_debug; + break; + } - no_hash_pointers = true; + if (!no_hash_pointers) + return; pr_warn("**********************************************************\n"); pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n"); @@ -2289,11 +2314,39 @@ int __init no_hash_pointers_enable(char *str) pr_warn("** the kernel, report this immediately to your system **\n"); pr_warn("** administrator! **\n"); pr_warn("** **\n"); + pr_warn("** Use hash_pointers=always to force this mode off **\n"); + pr_warn("** **\n"); pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n"); pr_warn("**********************************************************\n"); +} + +static int __init hash_pointers_mode_parse(char *str) +{ + if (!str) { + pr_warn("Hash pointers mode empty; falling back to auto.\n"); + hash_pointers_mode = HASH_PTR_AUTO; + } else if (strncmp(str, "auto", 4) == 0) { + pr_info("Hash pointers mode set to auto.\n"); + hash_pointers_mode = HASH_PTR_AUTO; + } else if (strncmp(str, "never", 5) == 0) { + pr_info("Hash pointers mode set to never.\n"); + hash_pointers_mode = HASH_PTR_NEVER; + } else if (strncmp(str, "always", 6) == 0) { + pr_info("Hash pointers mode set to always.\n"); + hash_pointers_mode = HASH_PTR_ALWAYS; + } else { + pr_warn("Unknown hash_pointers mode '%s' specified; assuming auto.\n", str); + hash_pointers_mode = HASH_PTR_AUTO; + } return 0; } +early_param("hash_pointers", hash_pointers_mode_parse); + +static int __init no_hash_pointers_enable(char *str) +{ + return hash_pointers_mode_parse("never"); +} early_param("no_hash_pointers", no_hash_pointers_enable); /* diff --git a/mm/slub.c b/mm/slub.c index b46f87662e71..f3d61b330a76 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -6314,9 +6314,8 @@ void __init kmem_cache_init(void) if (debug_guardpage_minorder()) slub_max_order = 0; - /* Print slub debugging pointers without hashing */ - if (__slub_debug_enabled()) - no_hash_pointers_enable(NULL); + /* Inform pointer hashing choice about slub debugging state. */ + hash_pointers_finalize(__slub_debug_enabled()); kmem_cache_node = &boot_kmem_cache_node; kmem_cache = &boot_kmem_cache;