linux-hardening - Re: [PATCH v3] slab: Introduce kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <eae36648-6f9f-486d-b352-c92a315431a1@intel.com>
Date: Fri, 23 Aug 2024 06:27:58 +0200
From: Przemek Kitszel <przemyslaw.kitszel@...el.com>
To: Kees Cook <kees@...nel.org>, Vlastimil Babka <vbabka@...e.cz>
CC: Christoph Lameter <cl@...ux.com>, Pekka Enberg <penberg@...nel.org>, David
 Rientjes <rientjes@...gle.com>, Joonsoo Kim <iamjoonsoo.kim@....com>, Andrew
 Morton <akpm@...ux-foundation.org>, Roman Gushchin
	<roman.gushchin@...ux.dev>, Hyeonggon Yoo <42.hyeyoo@...il.com>, "Gustavo A .
 R . Silva" <gustavoars@...nel.org>, Bill Wendling <morbo@...gle.com>, "Justin
 Stitt" <justinstitt@...gle.com>, Jann Horn <jannh@...gle.com>, Marco Elver
	<elver@...gle.com>, <linux-mm@...ck.org>, Nathan Chancellor
	<nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>,
	<linux-kernel@...r.kernel.org>, <llvm@...ts.linux.dev>,
	<linux-hardening@...r.kernel.org>
Subject: Re: [PATCH v3] slab: Introduce kmalloc_obj() and family

On 8/23/24 01:13, Kees Cook wrote:

> (...) For cases where the total size of the allocation is needed,
> the kmalloc_obj_sz(), kmalloc_objs_sz(), and kmalloc_flex_sz() family
> of macros can be used. For example:
> 
> 	info->size = struct_size(ptr, flex_member, count);
> 	ptr = kmalloc(info->size, gfp);
> 
> becomes:
> 
> 	kmalloc_flex_sz(ptr, flex_member, count, gfp, &info->size);
> 
> Internal introspection of allocated type now becomes possible, allowing
> for future alignment-aware choices and hardening work. For example,
> adding __alignof(*ptr) as an argument to the internal allocators so that
> appropriate/efficient alignment choices can be made, or being able to
> correctly choose per-allocation offset randomization within a bucket
> that does not break alignment requirements.
> 
> Introduces __flex_count() for when __builtin_get_counted_by() is added
> by GCC[1] and Clang[2]. The internal use of __flex_count() allows for
> automatically setting the counter member of a struct's flexible array
> member when it has been annotated with __counted_by(), avoiding any
> missed early size initializations while __counted_by() annotations are
> added to the kernel. Additionally, this also checks for "too large"
> allocations based on the type size of the counter variable. For example:
> 
> 	if (count > type_max(ptr->flex_count))
> 		fail...;
> 	info->size = struct_size(ptr, flex_member, count);
> 	ptr = kmalloc(info->size, gfp);
> 	ptr->flex_count = count;
> 
> becomes (i.e. unchanged from earlier example):
> 
> 	kmalloc_flex_sz(ptr, flex_member, count, gfp, &info->size);

As there could be no __builtin_get_counted_by() available, caller still
needs to fill the counted-by variable, right? So it is possible to just
pass the in the struct pointer to fill? (last argument "&f->cnt" of the
snippet below):

struct foo {
	int cnt;
	struct bar[] __counted_by(cnt);
};

//...
	struct foo *f;

	kmalloc_flex_sz(f, cnt, 42, gfp, &f->cnt);