xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lkdtm/heap: Avoid edge and middle of slabs

Browse Source 
Har har, after I moved the slab freelist pointer into the middle of the
slab, now it looks like the contents are getting poisoned. Adjust the
test to avoid the freelist pointer again.

Fixes: 3202fa62fb ("slub: relocate freelist pointer to middle of object")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20200625203704.317097-3-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Kees Cook
2020-06-25 13:37:02 -07:00
committed by Greg Kroah-Hartman
parent 464e86b4ab
commit e12145cf1c
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/misc/lkdtm/heap.c
View File

@@ -58,11 +58,12 @@ void lkdtm_READ_AFTER_FREE(void)
int *base, *val, saw; int *base, *val, saw;
size_t len = 1024; size_t len = 1024;
/* /*
* The slub allocator uses the first word to store the free * The slub allocator will use the either the first word or
* pointer in some configurations. Use the middle of the * the middle of the allocation to store the free pointer,
* allocation to avoid running into the freelist * depending on configurations. Store in the second word to
* avoid running into the freelist.
*/ */
size_t offset = (len / sizeof(*base)) / 2; size_t offset = sizeof(*base);
base = kmalloc(len, GFP_KERNEL); base = kmalloc(len, GFP_KERNEL);
if (!base) { if (!base) {