linux-kernel - Re: [PATCH v6 2/2] slub: Introduce CONFIG_SLUB_RCU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG48ez0ggtaV8MF-bzzS2=zKg-3nfG1G_QaqGdesAJpQSj39TQ@mail.gmail.com>
Date: Fri, 2 Aug 2024 23:35:14 +0200
From: Jann Horn <jannh@...gle.com>
To: Andrey Konovalov <andreyknvl@...il.com>
Cc: Andrey Ryabinin <ryabinin.a.a@...il.com>, Alexander Potapenko <glider@...gle.com>, 
	Dmitry Vyukov <dvyukov@...gle.com>, Vincenzo Frascino <vincenzo.frascino@....com>, 
	Andrew Morton <akpm@...ux-foundation.org>, Christoph Lameter <cl@...ux.com>, 
	Pekka Enberg <penberg@...nel.org>, David Rientjes <rientjes@...gle.com>, 
	Joonsoo Kim <iamjoonsoo.kim@....com>, Vlastimil Babka <vbabka@...e.cz>, 
	Roman Gushchin <roman.gushchin@...ux.dev>, Hyeonggon Yoo <42.hyeyoo@...il.com>, 
	Marco Elver <elver@...gle.com>, kasan-dev@...glegroups.com, linux-kernel@...r.kernel.org, 
	linux-mm@...ck.org, syzbot+263726e59eab6b442723@...kaller.appspotmail.com
Subject: Re: [PATCH v6 2/2] slub: Introduce CONFIG_SLUB_RCU_DEBUG

On Fri, Aug 2, 2024 at 10:54 PM Andrey Konovalov <andreyknvl@...il.com> wrote:
> On Fri, Aug 2, 2024 at 10:32 PM Jann Horn <jannh@...gle.com> wrote:
> >
> > Currently, KASAN is unable to catch use-after-free in SLAB_TYPESAFE_BY_RCU
> > slabs because use-after-free is allowed within the RCU grace period by
> > design.
> >
> > Add a SLUB debugging feature which RCU-delays every individual
> > kmem_cache_free() before either actually freeing the object or handing it
> > off to KASAN, and change KASAN to poison freed objects as normal when this
> > option is enabled.
[...]
> > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c
[...]
> > +static void kmem_cache_rcu_uaf(struct kunit *test)
> > +{
> > +       char *p;
> > +       size_t size = 200;
> > +       struct kmem_cache *cache;
> > +
> > +       KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_SLUB_RCU_DEBUG);
>
> Ah, notice another thing: this test might fail of someone enables
> CONFIG_SLUB_RCU_DEBUG with HW_TAGS, right? I think we need another
> check here.

Why? I realize that HW_TAGS can't detect UAF in a TYPESAFE_BY_RCU slab
after an object has been reused, but here we do no other allocations,
so the object should still be free. And the kmalloc_uaf test also
doesn't check for HW_TAGS.

The one thing I know of that could make this test spuriously fail
would be an allocation failure in the SLUB code for delayed freeing
(but that'd only happen under memory pressure, which I think normally
doesn't exist when kunit tests run).