Ongoing slab hardening efforts

Recently, there have been multiple efforts to make the exploitation of slab memory corruptions harder.

1️⃣ RANDOM_KMALLOC_CACHES by Ruigi Gong; merged in v6.6; enabled in Ubuntu 24.04; LWN article

This feature creates 16 instances of each normal kmalloc cache and makes kmalloc randomly pick one of them based on the code location of the kmalloc call.

2️⃣ SLAB_BUCKETS by Kees Cook; merged in v6.11; LWN article

It allows putting specific dynamically-sized allocations into separate caches called buckets. This requires annotating allocation sites. This feature is intended to be used for user-controllable allocations. So far, only msg_msg and v/memdup_user allocations are annotated.

3️⃣ SLAB_PER_SITE by Kees Cook; under discussion; LWN article

This patchset creates a set of buckets for each kmalloc call site without manual annotations.

4️⃣ SLAB_VIRTUAL by Jann Horn and Matteo Rizzo; under discussion; documentation

It mitigates cross-cache attacks by making the slab allocator use a unique virtual memory address range for each cache for allocating slabs.