On 2023/05/14 17:30, Vlastimil Babka wrote: > On 5/12/23 12:11, Gong Ruiqi wrote: >> >> >> On 2023/05/11 2:43, Hyeonggon Yoo wrote: >>> On Mon, May 8, 2023 at 12:53 AM GONG, Ruiqi <gongruiqi1@xxxxxxxxxx> wrote: >>>> >> >> [...] >> >>>> >>>> The overhead of performance has been tested on a 40-core x86 server by >>>> comparing the results of `perf bench all` between the kernels with and >>>> without this patch based on the latest linux-next kernel, which shows >>>> minor difference. A subset of benchmarks are listed below: >>>> >>> >>> Please Cc maintainers/reviewers of corresponding subsystem in MAINTAINERS file. >> >> Okay, I've appended maintainers/reviewers of linux-hardening and >> security subsystem to the Cc list. > > I think they were CC'd on v1 but didn't respond yet. I thought maybe if > I run into Kees at OSS, I will ask him about it, but didn't happen. Yeah it would be great if you can contact Kees or other developers of hardening to know their opinions about this, since I'm curious about what they think of this as well. > As a slab maintainer I don't mind adding such things if they don't > complicate the code excessively, and have no overhead when configured > out. This one would seem to be acceptable at first glance, although > maybe the CONFIG space is too wide, and the amount of #defines in > slab_common.c is also large (maybe there's a way to make it more > concise, maybe not). > > But I don't have enough insight into hardening to decide if it's a > useful mitigation that people would enable, so I'd hope for hardening > folks to advise on that. Similar situation with freelist hardening in > the past, which was even actively pushed by Kees, IIRC. For the effectiveness of this mechanism, I would like to provide some results of the experiments I did. I conducted actual defense tests on CVE-2021-22555 and CVE-2016-8655 by reverting fixing patch to recreate exploitable environments, and running the exploits/PoCs on the vulnerable kernel with and without our randomized kmalloc caches patch. With our patch, the originally exploitable environments were not pwned by running the PoCs.
