From patchwork Mon Jul 17 16:45:07 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Popov X-Patchwork-Id: 9845765 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id F1B706037F for ; Mon, 17 Jul 2017 16:45:34 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E4D3028534 for ; Mon, 17 Jul 2017 16:45:34 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D9B1928539; Mon, 17 Jul 2017 16:45:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 17CB728534 for ; Mon, 17 Jul 2017 16:45:33 +0000 (UTC) Received: (qmail 17711 invoked by uid 550); 17 Jul 2017 16:45:31 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 17685 invoked from network); 17 Jul 2017 16:45:30 -0000 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id; bh=tKDF1ZB1IznjEG7gYsE9M6+MtFIgzx2n5t3/fp3aZik=; b=FPPEha82ZrdsgQEGF3dQbicnCsOCl46H9SMl+ssxb7051yjFnh6HJOnYraRbzh/fuS YsPFYpI+bRMMYidLg050c12xpNi0/NcU0HMQeEkaNOSWrIqmcteWHN3XANwFt1ybuGMW d0n+ZKdHpRPTH7HArHqU3zWlon+xHN+UAG+2PKuRgPVMjTXYM26iaDF014Vdv/q0HDG3 MrTCS0F+7Z+bACMizhWVr2vrP1UlYwzpdH7txPYEDxHQ2zK3EY3kEIlf6jjyYmp+Q7Gm YNtj7ENxfJ48f12r5aNX29Fx1jNMBI+4Ag5uOuWizFC/lijTVE7fO2NAT+168Ka1TMzY Uk+g== X-Gm-Message-State: AIVw112wSMWAO2Y1VgGeW8aKv66JG+0i2GC2Er2CU2+etb+4BkfX3LUn RjA0AO0ox5s/7g== X-Received: by 10.25.232.33 with SMTP id f33mr7320786lfh.123.1500309919493; Mon, 17 Jul 2017 09:45:19 -0700 (PDT) From: Alexander Popov To: Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, keescook@chromium.org, alex.popov@linux.com Date: Mon, 17 Jul 2017 19:45:07 +0300 Message-Id: <1500309907-9357-1-git-send-email-alex.popov@linux.com> X-Mailer: git-send-email 2.7.4 Subject: [kernel-hardening] [PATCH 1/1] mm/slub.c: add a naive detection of double free or corruption X-Virus-Scanned: ClamAV using ClamSMTP Add an assertion similar to "fasttop" check in GNU C Library allocator: an object added to a singly linked freelist should not point to itself. That helps to detect some double free errors (e.g. CVE-2017-2636) without slub_debug and KASAN. Testing with hackbench doesn't show any noticeable performance penalty. Signed-off-by: Alexander Popov --- mm/slub.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/slub.c b/mm/slub.c index 1d3f983..a106939b 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -261,6 +261,7 @@ static inline void *get_freepointer_safe(struct kmem_cache *s, void *object) static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) { + BUG_ON(object == fp); /* naive detection of double free or corruption */ *(void **)(object + s->offset) = fp; }