linux/init
Kees Cook 2482ddec67 mm: add SLUB free list pointer obfuscation
This SLUB free list pointer obfuscation code is modified from Brad
Spengler/PaX Team's code in the last public patch of grsecurity/PaX
based on my understanding of the code.  Changes or omissions from the
original code are mine and don't reflect the original grsecurity/PaX
code.

This adds a per-cache random value to SLUB caches that is XORed with
their freelist pointer address and value.  This adds nearly zero
overhead and frustrates the very common heap overflow exploitation
method of overwriting freelist pointers.

A recent example of the attack is written up here:

  http://cyseclabs.com/blog/cve-2016-6187-heap-off-by-one-exploit

and there is a section dedicated to the technique the book "A Guide to
Kernel Exploitation: Attacking the Core".

This is based on patches by Daniel Micay, and refactored to minimize the
use of #ifdef.

With 200-count cycles of "hackbench -g 20 -l 1000" I saw the following
run times:

 before:
 	mean 10.11882499999999999995
	variance .03320378329145728642
	stdev .18221905304181911048

  after:
	mean 10.12654000000000000014
	variance .04700556623115577889
	stdev .21680767106160192064

The difference gets lost in the noise, but if the above is to be taken
literally, using CONFIG_FREELIST_HARDENED is 0.07% slower.

Link: http://lkml.kernel.org/r/20170802180609.GA66807@beast
Signed-off-by: Kees Cook <keescook@chromium.org>
Suggested-by: Daniel Micay <danielmicay@gmail.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tycho Andersen <tycho@docker.com>
Cc: Alexander Popov <alex.popov@linux.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-09-06 17:27:24 -07:00
..
calibrate.c kernel: add calibration_delay_done() 2014-06-16 12:47:39 -06:00
do_mounts_initrd.c init/do_mounts: initrd_load() can be boolean 2016-01-20 17:09:18 -08:00
do_mounts_md.c init: disable sparse checking of the mount.o source files 2012-05-31 17:49:27 -07:00
do_mounts_rd.c init: use pr_cont() when displaying rotator during ramdisk loading. 2016-11-24 09:32:20 -08:00
do_mounts.c init: reduce rootwait polling interval time to 5ms 2016-12-12 18:55:10 -08:00
do_mounts.h initramfs: use vfs_stat/lstat directly 2017-05-08 17:15:12 -07:00
init_task.c sched/headers: Prepare to move 'init_task' and 'init_thread_union' from <linux/sched.h> to <linux/sched/task.h> 2017-03-02 08:42:38 +01:00
initramfs.c initramfs: use vfs_stat/lstat directly 2017-05-08 17:15:12 -07:00
Kconfig mm: add SLUB free list pointer obfuscation 2017-09-06 17:27:24 -07:00
main.c Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-09-04 12:21:28 -07:00
Makefile kbuild: allow archs to select link dead code/data elimination 2016-09-09 10:47:00 +02:00
noinitramfs.c init: mark __user address space on string literals 2010-10-26 16:52:15 -07:00
version.c locking/atomic, kref: Add KREF_INIT() 2017-01-14 11:37:18 +01:00