LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH 0/3] linux-next: mm: hardening: Track genalloc allocations
@ 2018-04-29  2:45 Igor Stoppa
  2018-04-29  2:45 ` [PATCH 1/3] genalloc: track beginning of allocations Igor Stoppa
                   ` (3 more replies)
  0 siblings, 4 replies; 12+ messages in thread
From: Igor Stoppa @ 2018-04-29  2:45 UTC (permalink / raw)
  To: mhocko, akpm, keescook, linux-mm, kernel-hardening,
	linux-security-module
  Cc: willy, labbott, linux-kernel, igor.stoppa

This patchset was created as part of an older version of pmalloc, however
it has value per-se, as it hardens the memory management for the generic
allocator genalloc.

Genalloc does not currently track the size of the allocations it hands out.

Either by mistake, or due to an attack, it is possible that more memory
than what was initially allocated is freed, leaving behind dangling
pointers, ready for an use-after-free attack.

With this patch, genalloc becomes capable of tracking the size of each
allocation it has handed out, when it's time to free it.

It can either verify that the size received, when free is invoked, is
correct, or it can decide autonomously how much memory to free, if the
value received for the size parameter is 0.

These patches are proposed for beign merged into linux-next, to verify
that they do not introduce regressions, by comparing the value received
from the callers of the free function with the internal tracking.

Later on, the "size" parameter can be dropped, and each caller can be
adjusted accordingly.

Signed-off-by: Igor Stoppa <igor.stoppa@huawei.com>

Igor Stoppa (3):
  genalloc: track beginning of allocations
  Add label and license to genalloc.rst
  genalloc: selftest

 Documentation/core-api/genalloc.rst |   4 +
 include/linux/genalloc.h            | 112 +++---
 init/main.c                         |   2 +
 lib/Kconfig                         |  15 +
 lib/Makefile                        |   1 +
 lib/genalloc.c                      | 742 ++++++++++++++++++++++++++----------
 lib/test_genalloc.c                 | 410 ++++++++++++++++++++
 7 files changed, 1031 insertions(+), 255 deletions(-)
 create mode 100644 lib/test_genalloc.c

-- 
2.14.1

^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH 0/3 v2] linux-next: mm: Track genalloc allocations
@ 2018-05-02  1:05 Igor Stoppa
  2018-05-02  1:05 ` [PATCH 1/3] genalloc: track beginning of allocations Igor Stoppa
  0 siblings, 1 reply; 12+ messages in thread
From: Igor Stoppa @ 2018-05-02  1:05 UTC (permalink / raw)
  To: mhocko, akpm, keescook, linux-mm, kernel-hardening,
	linux-security-module
  Cc: willy, labbott, linux-kernel, igor.stoppa

This patchset was created as part of an older version of pmalloc, however
it has value per-se, as it hardens the memory management for the generic
allocator genalloc.

Genalloc does not currently track the size of the allocations it hands
out.

Either by mistake, or due to an attack, it is possible that more memory
than what was initially allocated is freed, leaving behind dangling
pointers, ready for an use-after-free attack.

With this patch, genalloc becomes capable of tracking the size of each
allocation it has handed out, when it's time to free it.

It can either verify that the size received is correct, when free is
invoked, or it can decide autonomously how much memory to free, if the
value received for the size parameter is 0.

These patches are proposed for beign merged into linux-next, to verify
that they do not introduce regressions, by comparing the value received
from the callers of the free function with the internal tracking.

For this reason, the patchset does not contain the removal of the size
parameter from users of the free() function.

Later on, the "size" parameter can be dropped, and each caller can be
adjusted accordingly.

However, I do not have access to most of the HW required for confirming
that all of its users are not negatively affected.
This is where I believe having the patches in linux-next would help to
coordinate with the maintaiers of the code that uses gen_alloc.

Since there were comments about the (lack-of) efficiency introduced by
this patchset, I have added some more explanations and calculations to the
description of the first patch, the one adding the bitmap.
My conclusion is that this patch should not cause any major perfomance
problem.

Regarding the possibility of completely changing genalloc into some other
type of allocator, I think it should not be a showstopper for this
patchset, which aims to plug a security hole in genalloc, without
introducing any major regression.

The security flaw is clear and present, while the benefit of introducing a
new allocator is not clear, at least for the current users of genalloc.

And anyway the users of genalloc should be fixed to not pass any size
parameter, which can be done after this patch is merged.

A newer, more efficient allocator will still benefit from not receiving a
spurious parameter (size), when freeing memory.

Changes since v1:

[http://www.openwall.com/lists/kernel-hardening/2018/04/29/1]

* make the tester code a kernel module
* turn selftest BUG() error exit paths into WARN()
* add analysis of impact on current users of genalloc


Igor Stoppa (3):
  genalloc: track beginning of allocations
  Add label and license to genalloc.rst
  genalloc: selftest

 Documentation/core-api/genalloc.rst |   4 +
 include/linux/genalloc.h            | 112 +++---
 lib/Kconfig.debug                   |  23 ++
 lib/Makefile                        |   1 +
 lib/genalloc.c                      | 742 ++++++++++++++++++++++++++----------
 lib/test_genalloc.c                 | 419 ++++++++++++++++++++
 6 files changed, 1046 insertions(+), 255 deletions(-)
 create mode 100644 lib/test_genalloc.c

-- 
2.14.1

^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2018-05-02  1:05 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-29  2:45 [PATCH 0/3] linux-next: mm: hardening: Track genalloc allocations Igor Stoppa
2018-04-29  2:45 ` [PATCH 1/3] genalloc: track beginning of allocations Igor Stoppa
2018-04-29  2:45 ` [PATCH 2/3] Add label and license to genalloc.rst Igor Stoppa
2018-04-29  2:45 ` [PATCH 3/3] genalloc: selftest Igor Stoppa
2018-04-29  3:36   ` Randy Dunlap
2018-04-29 22:39     ` Igor Stoppa
2018-04-30  2:14   ` kbuild test robot
2018-04-30  4:04   ` kbuild test robot
2018-04-29  3:09 ` [PATCH 0/3] linux-next: mm: hardening: Track genalloc allocations Matthew Wilcox
2018-04-29 16:39   ` Igor Stoppa
2018-04-29 16:41     ` Igor Stoppa
2018-05-02  1:05 [PATCH 0/3 v2] linux-next: mm: " Igor Stoppa
2018-05-02  1:05 ` [PATCH 1/3] genalloc: track beginning of allocations Igor Stoppa

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).