Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) client-ip=2620:137:e000::3:1;
Date:   Fri, 15 Sep 2023 14:07:10 -0700
From:   Kees Cook <keescook@chromium.org>
To:     Matteo Rizzo <matteorizzo@google.com>
Cc:     cl@linux.com, penberg@kernel.org, rientjes@google.com,
        iamjoonsoo.kim@lge.com, akpm@linux-foundation.org, vbabka@suse.cz,
        roman.gushchin@linux.dev, 42.hyeyoo@gmail.com,
        linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org,
        linux-mm@kvack.org, linux-hardening@vger.kernel.org,
        tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
        dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
        corbet@lwn.net, luto@kernel.org, peterz@infradead.org,
        jannh@google.com, evn@google.com, poprdi@google.com,
        jordyzomer@google.com
Subject: Re: [RFC PATCH 08/14] security: introduce CONFIG_SLAB_VIRTUAL
Message-ID: <202309151407.2FD7F80B@keescook>
References: <20230915105933.495735-1-matteorizzo@google.com>
 <20230915105933.495735-9-matteorizzo@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230915105933.495735-9-matteorizzo@google.com>
Precedence: bulk

On Fri, Sep 15, 2023 at 10:59:27AM +0000, Matteo Rizzo wrote:
> From: Jann Horn <jannh@google.com>
> 
> SLAB_VIRTUAL is a mitigation for the SLUB allocator which prevents reuse
> of virtual addresses across different slab caches and therefore makes
> some types of use-after-free bugs unexploitable.
> 
> SLAB_VIRTUAL is incompatible with KASAN and we believe it's not worth
> adding support for it. This is because SLAB_VIRTUAL and KASAN are aimed
> at two different use cases: KASAN is meant for catching bugs as early as
> possible in debug/fuzz/testing builds, and it's not meant to be used in
> production. SLAB_VIRTUAL on the other hand is an exploit mitigation that
> doesn't attempt to highlight bugs but instead tries to make them
> unexploitable. It doesn't make sense to enable it in debugging builds or
> during fuzzing, and instead we expect that it will be enabled in
> production kernels.
> 
> SLAB_VIRTUAL is not currently compatible with KFENCE, removing this
> limitation is future work.
> 
> Signed-off-by: Jann Horn <jannh@google.com>

Reviewed-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook