BackPup/Linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-25 21:21:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

mm/slub.c: add a naive detection of double free or corruption

Browse Source 
Add an assertion similar to "fasttop" check in GNU C Library allocator
as a part of SLAB_FREELIST_HARDENED feature.  An object added to a
singly linked freelist should not point to itself.  That helps to detect
some double free errors (e.g. CVE-2017-2636) without slub_debug and
KASAN.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Alexander Popov <[email protected]>
Acked-by: Christoph Lameter <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Pekka Enberg <[email protected]>
Cc: David Rientjes <[email protected]>
Cc: Joonsoo Kim <[email protected]>
Cc: Paul E McKenney <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Tejun Heo <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Nicolas Pitre <[email protected]>
Cc: Rik van Riel <[email protected]>
Cc: Tycho Andersen <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Alexander Popov
2017-09-06 17:27:24 -07:00
committed by Linus Torvalds
parent 2482ddec67
commit ce6fa91b93
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mm/slub.c
+4
View File
@@ -290,6 +290,10 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
{
unsigned long freeptr_addr = (unsigned long)object + s->offset;
#ifdef CONFIG_SLAB_FREELIST_HARDENED
BUG_ON(object == fp); /* naive detection of double free or corruption */
#endif
*(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
}