Commit ce6fa91b authored Sep 06, 2017 by Alexander Popov Committed by Linus Torvalds Sep 06, 2017

mm/slub.c: add a naive detection of double free or corruption

Add an assertion similar to "fasttop" check in GNU C Library allocator
as a part of SLAB_FREELIST_HARDENED feature.  An object added to a
singly linked freelist should not point to itself.  That helps to detect
some double free errors (e.g. CVE-2017-2636) without slub_debug and
KASAN.

Link: http://lkml.kernel.org/r/1502468246-1262-1-git-send-email-alex.popov@linux.com


Signed-off-by: Alexander Popov <alex.popov@linux.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Paul E McKenney <paulmck@linux.vnet.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tycho Andersen <tycho@docker.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 2482ddec

mm/slub.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -290,6 +290,10 @@ static inline void set_freepointer(struct kmem_cache s, void object, void *fp)
		{
		unsigned long freeptr_addr = (unsigned long)object + s->offset;

		#ifdef CONFIG_SLAB_FREELIST_HARDENED
		BUG_ON(object == fp); /* naive detection of double free or corruption */
		#endif

		(void *)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
		}

Admin message