On Thu, Apr 10, 2025 at 10:44:31AM -0700, Kees Cook wrote: > Some system owners use slab_debug=FPZ (or similar) as a hardening option, > but do not want to be forced into having kernel addresses exposed due > to the implicit "no_hash_pointers" boot param setting.[1] > > Introduce the "hash_pointers" boot param, which defaults to "auto" > (the current behavior), but also includes "always" (forcing on hashing > even when "slab_debug=..." is defined), and "never". The existing > "no_hash_pointers" boot param becomes an alias for "hash_pointers=never". > > This makes it possible to boot with "slab_debug=FPZ hash_pointers=always". > > Link: https://github.com/KSPP/linux/issues/368 [1] > Fixes: 792702911f58 ("slub: force on no_hash_pointers when slub_debug is > enabled") > Co-developed-by: Sergio Perez Gonzalez <sperez...@gmail.com> > Signed-off-by: Sergio Perez Gonzalez <sperez...@gmail.com> > Signed-off-by: Kees Cook <k...@kernel.org> > --- > Cc: Vlastimil Babka <vba...@suse.cz> > Cc: Jonathan Corbet <cor...@lwn.net> > Cc: Petr Mladek <pmla...@suse.com> > Cc: Steven Rostedt <rost...@goodmis.org> > Cc: Andy Shevchenko <andriy.shevche...@linux.intel.com> > Cc: Rasmus Villemoes <li...@rasmusvillemoes.dk> > Cc: Sergey Senozhatsky <senozhat...@chromium.org> > Cc: Andrew Morton <a...@linux-foundation.org> > Cc: Christoph Lameter <c...@linux.com> > Cc: Pekka Enberg <penb...@kernel.org> > Cc: David Rientjes <rient...@google.com> > Cc: Joonsoo Kim <iamjoonsoo....@lge.com> > Cc: Roman Gushchin <roman.gushc...@linux.dev> > Cc: Harry Yoo <harry....@oracle.com> > Cc: "Paul E. McKenney" <paul...@kernel.org> > Cc: Randy Dunlap <rdun...@infradead.org> > Cc: Tamir Duberstein <tam...@gmail.com> > Cc: Miguel Ojeda <oj...@kernel.org> > Cc: Alice Ryhl <alicer...@google.com> > Cc: linux-doc@vger.kernel.org > Cc: linux...@kvack.org > --- > .../admin-guide/kernel-parameters.txt | 34 ++++++++----- > include/linux/sprintf.h | 2 +- > lib/vsprintf.c | 51 +++++++++++++++++-- > mm/slub.c | 5 +- > 4 files changed, 72 insertions(+), 20 deletions(-) > > diff --git a/Documentation/admin-guide/kernel-parameters.txt > b/Documentation/admin-guide/kernel-parameters.txt > index 76e538c77e31..d0fd9c745db9 100644 > --- a/Documentation/admin-guide/kernel-parameters.txt > +++ b/Documentation/admin-guide/kernel-parameters.txt > @@ -1798,6 +1798,27 @@ > backtraces on all cpus. > Format: 0 | 1 > > + hash_pointers= > + [KNL,EARLY] > + By default, when pointers are printed to the console > + or buffers via the %p format string, that pointer is > + "hashed", i.e. obscured by hashing the pointer value. > + This is a security feature that hides actual kernel > + addresses from unprivileged users, but it also makes > + debugging the kernel more difficult since unequal > + pointers can no longer be compared. The choices are: > + Format: { auto | always | never } > + Default: auto > + > + auto - Hash pointers unless slab_debug is enabled. > + always - Always hash pointers (even if slab_debug is > + enabled). > + never - Never hash pointers. This option should only > + be specified when debugging the kernel. Do > + not use on production kernels. The boot > + param "no_hash_pointers" is an alias for > + this mode.
So on production one would want hash pointers (i.e. auto/always), right? Anyway, the wording LGTM. Reviewed-by: Bagas Sanjaya <bagasdo...@gmail.com> PS: I'm confused on unspoken convention that anything but otherwise specified is suitable for production, as I'm expecting explicit version deployment (e.g. use <insert something> version instead of don't use <otherwise>). -- An old man doll... just what I always wanted! - Clara
signature.asc
Description: PGP signature
