From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF0BA376BF7 for ; Wed, 10 Jun 2026 06:50:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781074260; cv=none; b=KRoz4BOYqk4nO1bvGzUQkHy25BSLrXCvSjKmb+TxVthv5nkq8lvy1vNodUh1ZIQnwz0SDoUWc/RuwT9Zo6NVTZdbe3s0gj18FAH984zEBxF0jqp6nP3KsdBh+ZY3b1QCJgpislPNafMkRW2TYpcHuYPItOX7NPhr0WjQIKsqX2U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781074260; c=relaxed/simple; bh=79DnwxJFzJS6ztuiCswAItKY/iEYoA/hB5xT9+mHBVA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=KFoETW+q4K+a4z3U1YWPoKF9cOU91u7bXpeCS0INcDXvPkeGExGznn9M9ues7o+MZeuA9XvR6Q1+5C/8TzWKMFlLIIsCzSxYpuw93g3YPRFH3WoQMFXy5Oqz6Tz0zqyebtJqz9CKKG8x8s+0aLGCO4U5Eq7C9EFQmP5Xj7ykn2k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=frYluLQZ; arc=none smtp.client-ip=209.85.221.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="frYluLQZ" Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-45fd461e4a5so4421428f8f.0 for ; Tue, 09 Jun 2026 23:50:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781074257; x=1781679057; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=y/bLIEy6KRuoctCkoU9/pMoqja9vj+0u1Pq617vGiJU=; b=frYluLQZzpCw9Qj/omMLQTkeKDWA4SMnJEtf5l215JOPpOQV2iTX0ieWjG5q/47url ZJu3UffCYf9M6rrmyvf8EYF2eQSCoWQbRZu2Y0AxZ7a8Lcc99Klty7BLxu87G2OgoewP huH8o+9oxy7HsDwtce46voYMOSpQOfqxcIt5XF0uBU4CXHKgvGe7B+NO9HvWhwcusbhx 6mh/pyblwobPdgzpv4VuMWwTNQjMsRWTZT/1J8xeZbFq/+Bo1SSNFflXfKxk6GKgoEtW fC1CKednRHA3GaittscWbT37SY9hzqADCcDgNNmF1SqQu5+DiuNZuf6Hl9O0rX6xsR9H qs3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781074257; x=1781679057; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=y/bLIEy6KRuoctCkoU9/pMoqja9vj+0u1Pq617vGiJU=; b=errt/AEuYMnHU1RC9+tbe4DnEyEIFrg0rs5mjNxqhvQhnhLzIb1L3nKF6Pp7YxaGFg XXN9sHnXGD8LfoplQkNuVeZgKwQEvn07Ov2wrRuPOTpfzxjFBsWXxJg0/VJwltOJDNvw r7pBG+QOp7v5A/R1uPmsICo2+lxGBPROCss4PYs0HB9dpy6wOWSjATPbYNXHTyNBYr6j cUxbIgt2hwlGRMdx3l9ea1Ji8N8gQqduVeGCcoyWHp1BPZngLuKNOKqczVZcH5caGt+j airyqXmd8jlhB8btHydH7Z71Mx31DnnwL5X373KVWFqokhP5fpUvSzNLi8amAdpo25pN oZvg== X-Forwarded-Encrypted: i=1; AFNElJ99b+8Ris59mxB9zsj2UJJ7jqpnhms4ttts+WalzT8Y7lh9zJYeCGtABcUbMpezBGGmsWxmrEVjOr5o3Kw=@vger.kernel.org X-Gm-Message-State: AOJu0Yz/INwI8zHB8q4XFk/6a5HCE866SYBrSzkaeVW07t92PlAd03jF ok0joO/JCNVBhD2O6UxSzizKicXPp0XYH8jWZCK5DowxcTsl0RYitcM= X-Gm-Gg: Acq92OG97Lzk/Y5DQVKCgtkE0q9v0hhyZ+kISSsxqHCrldCjax/2gh3Pk/Jj2GyZ0KA FPA3ObZnY5O3YmKRl2YflhBBo6r1XtSyrNvZTx1j/NQX0j6/ShvQ3SskG9KJR8dNkBINsBu9rax uZpXwnmnhSGrf+ycb/GmuRbtI48+v/V4ZrdSFqN8yNaF5YSI2ZvMZgtKscboyLzTdEJIjsIEZGO oftVinrBiRx9/5hCGatGQ7pD6yud2IoLT9AdvY73V38ZSRqH+PD+cuPK/L8zQoQKvHaHjOtHQ9U HgG/cDaRV5fER1YIN11XbboitAxEAO+/8pswDhBzh9ub1cQ9+ZtJI+dvcFJbxBdY8SDBag9/0Xv WjIfEvcUgBJSMy+iEcs67rAu9vu7iu9HrEN6Szwxmsd+Dfs+20l+5PQY4sB/6apZ9cUsTUhQw+H sczNjOCHgyhDeMOcM6iHtQQu14fUmjEFgCBBm6CXK7sTPDcOiz5e2WpmcipXWcZpFfIvlN8Bk7G E3kRvmq22gapeE6koEdZJ5TwK2EsDs0mfGaDV6iEKo= X-Received: by 2002:a5d:4b41:0:b0:45e:f3b2:122a with SMTP id ffacd0b85a97d-46030652fcemr28960085f8f.26.1781074256955; Tue, 09 Jun 2026 23:50:56 -0700 (PDT) Received: from hp-ubuntu.. ([105.158.214.102]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4601f2e4004sm69539946f8f.9.2026.06.09.23.50.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 23:50:56 -0700 (PDT) From: Mohammed EL Kadiri To: dhowells@redhat.com, jarkko@kernel.org Cc: paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, kees@kernel.org, vbabka@kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org, Mohammed EL Kadiri Subject: [PATCH v2] keys: prevent slab cache merging for key_jar Date: Wed, 10 Jun 2026 07:50:52 +0100 Message-ID: <20260610065052.9120-1-med08elkadiri@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Add SLAB_NO_MERGE to key_jar to prevent the allocator from merging it with other similarly-sized caches. This hardens struct key isolation by ensuring dedicated slab pages. Acked-by: Vlastimil Babka (SUSE) Signed-off-by: Mohammed EL Kadiri --- security/keys/key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/keys/key.c b/security/keys/key.c index 3bbdde778631..592b65cf8539 100644 --- a/security/keys/key.c +++ b/security/keys/key.c @@ -1275,7 +1275,7 @@ void __init key_init(void) { /* allocate a slab in which we can store keys */ key_jar = kmem_cache_create("key_jar", sizeof(struct key), - 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); + 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC | SLAB_NO_MERGE, NULL); /* add the special key types */ list_add_tail(&key_type_keyring.link, &key_types_list); -- 2.43.0