Re: [PATCH v3 4/4] slub: Force on no_hash_pointers when slub_debug is enabled
From: Kees Cook <hidden>
Date: 2021-09-20 14:30:01
Also in:
lkml
On Tue, Jun 01, 2021 at 11:22:02AM -0700, Stephen Boyd wrote:
Obscuring the pointers that slub shows when debugging makes for some confusing slub debug messages: Padding overwritten. 0x0000000079f0674a-0x000000000d4dce17 Those addresses are hashed for kernel security reasons. If we're trying to be secure with slub_debug on the commandline we have some big problems given that we dump whole chunks of kernel memory to the kernel logs. Let's force on the no_hash_pointers commandline flag when slub_debug is on the commandline. This makes slub debug messages more meaningful and if by chance a kernel address is in some slub debug object dump we will have a better chance of figuring out what went wrong. Note that we don't use %px in the slub code because we want to reduce the number of places that %px is used in the kernel. This also nicely prints a big fat warning at kernel boot if slub_debug is on the commandline so that we know that this kernel shouldn't be used on production systems.
Eeeek. I missed this patch. NAK NAK. People use slub_debug for production systems to gain redzoning, etc, as a layer of defense, and they absolutely do not want %p-hashing disabled. %p hashing is controlled by the no_hash_pointers boot param (since v5.12), and needs to stay separate from slub_debug. Can we please revert this in Linus's tree and in v5.14? -Kees
quoted hunk ↗ jump to hunk
Signed-off-by: Stephen Boyd <redacted> --- include/linux/kernel.h | 2 ++ lib/vsprintf.c | 2 +- mm/slub.c | 4 ++++ 3 files changed, 7 insertions(+), 1 deletion(-)diff --git a/include/linux/kernel.h b/include/linux/kernel.h index 15d8bad3d2f2..bf950621febf 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h@@ -357,6 +357,8 @@ int sscanf(const char *, const char *, ...); extern __scanf(2, 0) int vsscanf(const char *, const char *, va_list); +extern int no_hash_pointers_enable(char *str); + extern int get_option(char **str, int *pint); extern char *get_options(const char *str, int nints, int *ints); extern unsigned long long memparse(const char *ptr, char **retptr);diff --git a/lib/vsprintf.c b/lib/vsprintf.c index f0c35d9b65bf..cc281f5895f9 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c@@ -2186,7 +2186,7 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode, bool no_hash_pointers __ro_after_init; EXPORT_SYMBOL_GPL(no_hash_pointers); -static int __init no_hash_pointers_enable(char *str) +int __init no_hash_pointers_enable(char *str) { if (no_hash_pointers) return 0;diff --git a/mm/slub.c b/mm/slub.c index bf4949115412..a722794f1dbd 100644 --- a/mm/slub.c +++ b/mm/slub.c@@ -4460,6 +4460,10 @@ void __init kmem_cache_init(void) if (debug_guardpage_minorder()) slub_max_order = 0; + /* Print slub debugging pointers without hashing */ + if (static_branch_unlikely(&slub_debug_enabled)) + no_hash_pointers_enable(NULL); + kmem_cache_node = &boot_kmem_cache_node; kmem_cache = &boot_kmem_cache;-- https://chromeos.dev
-- Kees Cook