From: Christopher Lameter <cl@linux.com>
To: Kees Cook <keescook@chromium.org>
Cc: Alexander Popov <alex.popov@linux.com>,
Andrew Morton <akpm@linux-foundation.org>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
Ingo Molnar <mingo@kernel.org>,
Josh Triplett <josh@joshtriplett.org>,
Andy Lutomirski <luto@kernel.org>,
Nicolas Pitre <nicolas.pitre@linaro.org>,
Tejun Heo <tj@kernel.org>, Daniel Mack <daniel@zonque.org>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Helge Deller <deller@gmx.de>, Rik van Riel <riel@redhat.com>,
Linux-MM <linux-mm@kvack.org>, Tycho Andersen <tycho@docker.com>,
LKML
<linux-kernel@vger.kernel.org>"kernel-hardening@lists.openwall.com"
<ke>
Subject: Re: [v3] mm: Add SLUB free list pointer obfuscation
Date: Wed, 26 Jul 2017 09:08:01 -0500 (CDT) [thread overview]
Message-ID: <alpine.DEB.2.20.1707260906230.6341@nuc-kabylake> (raw)
In-Reply-To: <CAGXu5jKRDhvqj0TU10W10hsdixN2P+hHzpYfSVvOFZy=hW72Mg@mail.gmail.com>
On Tue, 25 Jul 2017, Kees Cook wrote:
> > @@ -290,6 +290,10 @@ static inline void set_freepointer(struct kmem_cache *s,
> > void *object, void *fp)
> > {
> > unsigned long freeptr_addr = (unsigned long)object + s->offset;
> >
> > +#ifdef CONFIG_SLAB_FREELIST_HARDENED
> > + BUG_ON(object == fp); /* naive detection of double free or corruption */
> > +#endif
> > +
> > *(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
>
> What happens if, instead of BUG_ON, we do:
>
> if (unlikely(WARN_RATELIMIT(object == fp, "double-free detected"))
> return;
This may work for the free fastpath but the set_freepointer function is
use in multiple other locations. Maybe just add this to the fastpath
instead of to this fucnction?
next prev parent reply other threads:[~2017-07-26 14:08 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-06 0:27 [PATCH v3] " Kees Cook
2017-07-06 13:43 ` Christoph Lameter
2017-07-06 15:48 ` Kees Cook
2017-07-06 15:55 ` Christoph Lameter
2017-07-06 16:16 ` [kernel-hardening] " Daniel Micay
2017-07-06 17:53 ` Rik van Riel
2017-07-06 18:50 ` Kees Cook
2017-07-07 13:50 ` Christoph Lameter
2017-07-07 16:51 ` Kees Cook
2017-07-07 17:06 ` Christoph Lameter
2017-07-07 18:43 ` Kees Cook
2017-07-24 21:17 ` [v3] " Alexander Popov
2017-07-25 9:42 ` Alexander Popov
2017-07-26 0:21 ` Kees Cook
2017-07-26 14:08 ` Christopher Lameter [this message]
2017-07-26 16:20 ` Kees Cook
2017-07-26 16:55 ` Christopher Lameter
2017-07-26 17:13 ` Kees Cook
2017-07-27 15:15 ` Christopher Lameter
2017-07-27 22:48 ` Alexander Popov
2017-07-27 23:53 ` Christopher Lameter
2017-07-31 20:17 ` Alexander Popov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.20.1707260906230.6341@nuc-kabylake \
--to=cl@linux.com \
--cc=akpm@linux-foundation.org \
--cc=alex.popov@linux.com \
--cc=bigeasy@linutronix.de \
--cc=daniel@zonque.org \
--cc=deller@gmx.de \
--cc=iamjoonsoo.kim@lge.com \
--cc=josh@joshtriplett.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=nicolas.pitre@linaro.org \
--cc=paulmck@linux.vnet.ibm.com \
--cc=penberg@kernel.org \
--cc=riel@redhat.com \
--cc=rientjes@google.com \
--cc=sergey.senozhatsky@gmail.com \
--cc=tj@kernel.org \
--cc=tycho@docker.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox