The patch titled
Subject: mm/slub.c: add a naive detection of double free or corruption
has been added to the -mm tree. Its filename is
mm-slubc-add-a-naive-detection-of-double-free-or-corruption.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-slubc-add-a-naive-detection-of-double-free-or-corruption.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-slubc-add-a-naive-detection-of-double-free-or-corruption.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Alexander Popov <alex.popov@xxxxxxxxx>
Subject: mm/slub.c: add a naive detection of double free or corruption
Add an assertion similar to "fasttop" check in GNU C Library allocator as
a part of SLAB_FREELIST_HARDENED feature. An object added to a singly
linked freelist should not point to itself. That helps to detect some
double free errors (e.g. CVE-2017-2636) without slub_debug and KASAN.
Link: http://lkml.kernel.org/r/1502468246-1262-1-git-send-email-alex.popov@xxxxxxxxx
Signed-off-by: Alexander Popov <alex.popov@xxxxxxxxx>
Acked-by: Christoph Lameter <cl@xxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Pekka Enberg <penberg@xxxxxxxxxx>
Cc: David Rientjes <rientjes@xxxxxxxxxx>
Cc: Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>
Cc: Paul E McKenney <paulmck@xxxxxxxxxxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Tejun Heo <tj@xxxxxxxxxx>
Cc: Andy Lutomirski <luto@xxxxxxxxxx>
Cc: Nicolas Pitre <nicolas.pitre@xxxxxxxxxx>
Cc: Rik van Riel <riel@xxxxxxxxxx>
Cc: Tycho Andersen <tycho@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/slub.c | 4 ++++
1 file changed, 4 insertions(+)
diff -puN mm/slub.c~mm-slubc-add-a-naive-detection-of-double-free-or-corruption mm/slub.c
--- a/mm/slub.c~mm-slubc-add-a-naive-detection-of-double-free-or-corruption
+++ a/mm/slub.c
@@ -290,6 +290,10 @@ static inline void set_freepointer(struc
{
unsigned long freeptr_addr = (unsigned long)object + s->offset;
+#ifdef CONFIG_SLAB_FREELIST_HARDENED
+ BUG_ON(object == fp); /* naive detection of double free or corruption */
+#endif
+
*(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
}
_
Patches currently in -mm which might be from alex.popov@xxxxxxxxx are
mm-slubc-add-a-naive-detection-of-double-free-or-corruption.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
