On Tue, 29 Jan 2019, Kees Cook wrote: > It seems like a fatal condition to me? There's nothing to check that > such a page wouldn't get freed by the slab while still mapped to > userspace, right? Lets just fail the code. Currently this may work with SLUB. But SLAB and SLOB overlay fields with mapcount. So you would have a corrupted page struct if you mapped a slab page to user space.
