Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210312121653.348518-1-elver@google.com>
In-Reply-To: <20210312121653.348518-1-elver@google.com>
From:   Alexander Potapenko <glider@google.com>
Date:   Fri, 12 Mar 2021 14:11:35 +0100
Message-ID: <CAG_fn=WdpzPxbvzqkpVXjyrUu=GprA2xMBiJdhJqM8cNhABWmw@mail.gmail.com>
Subject: Re: [PATCH mm] kfence: zero guard page after out-of-bounds access
To:     Marco Elver <elver@google.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Dmitriy Vyukov <dvyukov@google.com>,
        Andrey Konovalov <andreyknvl@google.com>,
        Jann Horn <jannh@google.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Linux Memory Management List <linux-mm@kvack.org>,
        kasan-dev <kasan-dev@googlegroups.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Fri, Mar 12, 2021 at 1:16 PM Marco Elver <elver@google.com> wrote:
>
> After an out-of-bounds accesses, zero the guard page before
> re-protecting in kfence_guarded_free(). On one hand this helps make the
> failure mode of subsequent out-of-bounds accesses more deterministic,
> but could also prevent certain information leaks.
>
> Signed-off-by: Marco Elver <elver@google.com>
Acked-by: Alexander Potapenko <glider@google.com>

> ---
>  mm/kfence/core.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/mm/kfence/core.c b/mm/kfence/core.c
> index 3b8ec938470a..f7106f28443d 100644
> --- a/mm/kfence/core.c
> +++ b/mm/kfence/core.c
> @@ -371,6 +371,7 @@ static void kfence_guarded_free(void *addr, struct kf=
ence_metadata *meta, bool z
>
>         /* Restore page protection if there was an OOB access. */
>         if (meta->unprotected_page) {
> +               memzero_explicit((void *)ALIGN_DOWN(meta->unprotected_pag=
e, PAGE_SIZE), PAGE_SIZE);
>                 kfence_protect(meta->unprotected_page);
>                 meta->unprotected_page =3D 0;
>         }
> --
> 2.31.0.rc2.261.g7f71774620-goog
>


--=20
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Stra=C3=9Fe, 33
80636 M=C3=BCnchen

Gesch=C3=A4ftsf=C3=BChrer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg