On Mon, 7 Aug 2017, Kees Cook wrote: > > To clarify, this is desirable to kill exploitation of > exposure-after-free flaws and some classes of use-after-free flaws, > since the contents will have be wiped out after a free. (Verification > of poison is nice, but is expensive compared to the benefit against > these exploits -- and notably doesn't protect against the other > use-after-free attacks where the contents are changed after the next > allocation, which would have passed the poison verification.) Well the only variable in the freed area that is in use by the allocator is the free pointer. This ensures that complete object is poisoned and the free pointer has a separate storage area right? So the size of the slab objects increase. In addition to more hotpath processing we also have increased object sizes. I am not familiar with the terminology here. So exposure-after-free means that the contents of the object can be used after it was freed? Contents are changed after allocation? Someone gets a pointer to the object and the mods it later? -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
