android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lkdtm/heap: Avoid edge and middle of slabs

Browse Source 
Har har, after I moved the slab freelist pointer into the middle of the
slab, now it looks like the contents are getting poisoned. Adjust the
test to avoid the freelist pointer again.

Fixes: 3202fa62fb ("slub: relocate freelist pointer to middle of object")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20200625203704.317097-3-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Kees Cook 2020-06-25 13:37:02 -07:00 committed by Greg Kroah-Hartman
parent 464e86b4ab
commit e12145cf1c
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/misc/lkdtm/heap.c
View File

@ -58,11 +58,12 @@ void lkdtm_READ_AFTER_FREE(void)
int *base, *val, saw;
size_t len = 1024;
/*
* The slub allocator uses the first word to store the free
* pointer in some configurations. Use the middle of the
* allocation to avoid running into the freelist
* The slub allocator will use the either the first word or
* the middle of the allocation to store the free pointer,
* depending on configurations. Store in the second word to
* avoid running into the freelist.
*/
size_t offset = (len / sizeof(*base)) / 2;
size_t offset = sizeof(*base);
base = kmalloc(len, GFP_KERNEL);
if (!base) {