Message ID | 20230915105933.495735-9-matteorizzo@google.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:172:b0:3f2:4152:657d with SMTP id h50csp1011581vqi; Fri, 15 Sep 2023 05:38:32 -0700 (PDT) X-Google-Smtp-Source: AGHT+IELokFbnylsW8nN/w+CXSP/I9lw/hkW6b0Vzct7ZwSoCFLif4TUDuxJhffuedBJ/zQnK0Bj X-Received: by 2002:a05:6a20:8e0f:b0:134:d4d3:f0a8 with SMTP id y15-20020a056a208e0f00b00134d4d3f0a8mr1949561pzj.3.1694781512534; Fri, 15 Sep 2023 05:38:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1694781512; cv=none; d=google.com; s=arc-20160816; b=JG688ksOakHu4vw6y59jsvwwtcjun5auPqvJouLY2K+IRSN4Z4m3OvkY1mEGOeWNfp SE+THLPgiPjUBiqk/rLKnsZJV51L+yqagEENTdKonhwTYfFqbQdSHrwdNJJmb3NjgYii FV8l9xYIcf0miNf5nxYWWl2xPDC0ktwocXjNUcuqSCyfAqG7MEzkrZvr8svPkeeCh8OO h6sFNXDYQYX+ay2YdUQ+7teN/qoOANBKghjGe+cmv5eXYJb74k6Eo+L1FeYqr5LnCivZ beaZDAoP1c56ju6Eya+8F07QY1Sgt62JVeXXYO7y1Y4dtUEiAnppIUcqXt6LDGcd+wHc uPTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:dkim-signature; bh=PIsfdB6xTDxZC/lwkP7uk8Z8Jcdw9pIYLJmg+xNA39E=; fh=hxrcP/evkFXgdiqiA6zEdvE31LUTUVye/z/fSCqBw68=; b=wA2r55d7SWUVyKmO5Vv6+810wJeu0vFnrkwAx03xOmRBDmeYYNdppzTsMsDqyON3H0 X6eKwjhZ4PTOcYGvSPtZLLA30XlgiYmEYj9ejrRndLpi1dNXGpmLarSluIBevZHTVctP z5lNUmSoSZidYF+8Rp14e7apy8t2nX/VGAIT1G5J+QIg+1mhlq3vperMD9o2ofo8MGpe clIc3a+YdAXhlXzWsCyy8djiU2F0B8/PZBauOhTfk0y5wSLIl6hbkC9Im8hOHMHJrCWb l53bjYiEefjpGy+lBpIjwjxpdbBshFWI2OJ///FL3ICfVjkDWC1PJvBVchsqoemnMEqV 2XAw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=2vUDZjgv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from fry.vger.email (fry.vger.email. [23.128.96.38]) by mx.google.com with ESMTPS id cp16-20020a056a00349000b0068ffd96e1d4si3261845pfb.165.2023.09.15.05.38.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Sep 2023 05:38:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20230601 header.b=2vUDZjgv; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by fry.vger.email (Postfix) with ESMTP id 2FD82801DD89; Fri, 15 Sep 2023 04:01:12 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at fry.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234354AbjIOLA3 (ORCPT <rfc822;ruipengqi7@gmail.com> + 32 others); Fri, 15 Sep 2023 07:00:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234311AbjIOLAY (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Fri, 15 Sep 2023 07:00:24 -0400 Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C8BD1BF2 for <linux-kernel@vger.kernel.org>; Fri, 15 Sep 2023 03:59:59 -0700 (PDT) Received: by mail-yb1-xb4a.google.com with SMTP id 3f1490d57ef6-d817775453dso2243041276.2 for <linux-kernel@vger.kernel.org>; Fri, 15 Sep 2023 03:59:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1694775598; x=1695380398; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=PIsfdB6xTDxZC/lwkP7uk8Z8Jcdw9pIYLJmg+xNA39E=; b=2vUDZjgvuJgT6Dxl96lpPH2wdVDJTwodMyV+fgNSXrXWT39dB78Ag5ylWhOB6Ng213 VcaopasHaEJZl7Q1UrT0FoVUJCkrcCSlnxLz7I8g0tcGM6BG0T7LAszHfQj3JZ6ZpKbB YQR+GK0WpNc27Qu6Wi0ouGX/KiDXdd6qZIHy75+0tPXuhBa2bXos3QzUmgA4BAbqb78o YaGcHh2ENF3PkXvYE8zSppYsW/skio12alDCH5V3jj4Sxp/sGgS+O87Dy3Hu9twJf+co uO2aPSyDPkJqlrjaJ4Uedwr484h3CKPnSQ2RQH4Wn0O+uqhfmz8oQ7pjmOk955rdW4KC XhjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694775598; x=1695380398; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=PIsfdB6xTDxZC/lwkP7uk8Z8Jcdw9pIYLJmg+xNA39E=; b=HvFKJ989LZ31hK/FmbNHdJVBMcSE7xRx3yZ5fBWDx4DYKiZDXmY3KXgF0KtUSs4wFv g9Tv+p0FoW5ZATgcnFEcz7WE8Z9UgOpecjVBIAKanQN5AyCWTJvsJRnWL98rXFe/Nvzq 12fRIioRTPFuZO3GRyfAbRL64LGzy3a4bVWfR/HdXOPtMhCTVgsKTxEsR1aeuf5c2qB5 WtgRO4w2QiHXerVIgZ7ldmupCWCyoysdmjGhJR5Pv2/ITpbLWVfGMDBZ3k8PilA4RFiq yntW7mSmb9qsyVJXS/HMIMKuQl1wrA8Ct2aJPT92aRcMhSRBttrLbgEvataBdAqPWHxL fa1Q== X-Gm-Message-State: AOJu0YzNklRA4AcQEuiYTpPGWOwRx2N0pV432HGquAIJITXjB3nMdQrV dw9kgBZm6GebK3InocMp7wbYp+9syqI1b4CDbw== X-Received: from mr-cloudtop2.c.googlers.com ([fda3:e722:ac3:cc00:31:98fb:c0a8:2a6]) (user=matteorizzo job=sendgmr) by 2002:a5b:d10:0:b0:d81:7f38:6d65 with SMTP id y16-20020a5b0d10000000b00d817f386d65mr22869ybp.2.1694775598311; Fri, 15 Sep 2023 03:59:58 -0700 (PDT) Date: Fri, 15 Sep 2023 10:59:27 +0000 In-Reply-To: <20230915105933.495735-1-matteorizzo@google.com> Mime-Version: 1.0 References: <20230915105933.495735-1-matteorizzo@google.com> X-Mailer: git-send-email 2.42.0.459.ge4e396fd5e-goog Message-ID: <20230915105933.495735-9-matteorizzo@google.com> Subject: [RFC PATCH 08/14] security: introduce CONFIG_SLAB_VIRTUAL From: Matteo Rizzo <matteorizzo@google.com> To: cl@linux.com, penberg@kernel.org, rientjes@google.com, iamjoonsoo.kim@lge.com, akpm@linux-foundation.org, vbabka@suse.cz, roman.gushchin@linux.dev, 42.hyeyoo@gmail.com, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, corbet@lwn.net, luto@kernel.org, peterz@infradead.org Cc: jannh@google.com, matteorizzo@google.com, evn@google.com, poprdi@google.com, jordyzomer@google.com Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-8.4 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Fri, 15 Sep 2023 04:01:12 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1777107219309405263 X-GMAIL-MSGID: 1777107219309405263 |
Series |
Prevent cross-cache attacks in the SLUB allocator
|
|
Commit Message
Matteo Rizzo
Sept. 15, 2023, 10:59 a.m. UTC
From: Jann Horn <jannh@google.com> SLAB_VIRTUAL is a mitigation for the SLUB allocator which prevents reuse of virtual addresses across different slab caches and therefore makes some types of use-after-free bugs unexploitable. SLAB_VIRTUAL is incompatible with KASAN and we believe it's not worth adding support for it. This is because SLAB_VIRTUAL and KASAN are aimed at two different use cases: KASAN is meant for catching bugs as early as possible in debug/fuzz/testing builds, and it's not meant to be used in production. SLAB_VIRTUAL on the other hand is an exploit mitigation that doesn't attempt to highlight bugs but instead tries to make them unexploitable. It doesn't make sense to enable it in debugging builds or during fuzzing, and instead we expect that it will be enabled in production kernels. SLAB_VIRTUAL is not currently compatible with KFENCE, removing this limitation is future work. Signed-off-by: Jann Horn <jannh@google.com> Co-developed-by: Matteo Rizzo <matteorizzo@google.com> Signed-off-by: Matteo Rizzo <matteorizzo@google.com> --- security/Kconfig.hardening | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
Comments
On Fri, Sep 15, 2023 at 10:59:27AM +0000, Matteo Rizzo wrote: > From: Jann Horn <jannh@google.com> > > SLAB_VIRTUAL is a mitigation for the SLUB allocator which prevents reuse > of virtual addresses across different slab caches and therefore makes > some types of use-after-free bugs unexploitable. > > SLAB_VIRTUAL is incompatible with KASAN and we believe it's not worth > adding support for it. This is because SLAB_VIRTUAL and KASAN are aimed > at two different use cases: KASAN is meant for catching bugs as early as > possible in debug/fuzz/testing builds, and it's not meant to be used in > production. SLAB_VIRTUAL on the other hand is an exploit mitigation that > doesn't attempt to highlight bugs but instead tries to make them > unexploitable. It doesn't make sense to enable it in debugging builds or > during fuzzing, and instead we expect that it will be enabled in > production kernels. > > SLAB_VIRTUAL is not currently compatible with KFENCE, removing this > limitation is future work. > > Signed-off-by: Jann Horn <jannh@google.com> Reviewed-by: Kees Cook <keescook@chromium.org>
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening index 0f295961e773..9f4e6e38aa76 100644 --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -355,4 +355,18 @@ config GCC_PLUGIN_RANDSTRUCT * https://grsecurity.net/ * https://pax.grsecurity.net/ +config SLAB_VIRTUAL + bool "Allocate slab objects from virtual memory" + depends on SLUB && !SLUB_TINY + # If KFENCE support is desired, it could be implemented on top of our + # virtual memory allocation facilities + depends on !KFENCE + # ASAN support will require that shadow memory is allocated + # appropriately. + depends on !KASAN + help + Allocate slab objects from kernel-virtual memory, and ensure that + virtual memory used as a slab cache is never reused to store + objects from other slab caches or non-slab data. + endmenu