| Message ID | 20200203102953.17349-1-glider@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | lib/stackdepot: fix global out-of-bounds in stack_slabs | expand |
On 2020/02/03 19:29, glider@google.com wrote: > --- a/lib/stackdepot.c > +++ b/lib/stackdepot.c > @@ -84,7 +84,9 @@ static bool init_stack_slab(void **prealloc) > if (stack_slabs[depot_index] == NULL) { > stack_slabs[depot_index] = *prealloc; > } else { > - stack_slabs[depot_index + 1] = *prealloc; > + /* If this is the last depot slab, do not touch the next one. */ > + if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) > + stack_slabs[depot_index + 1] = *prealloc; What prevents memory leak (caused by "*prealloc = NULL;") when we hit depot_index + 1 >= STACK_ALLOC_MAX_SLABS condition? > /* > * This smp_store_release pairs with smp_load_acquire() from > * |next_slab_inited| above and in stack_depot_save(). >
> > - stack_slabs[depot_index + 1] = *prealloc; > > + /* If this is the last depot slab, do not touch the next one. */ > > + if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) > > + stack_slabs[depot_index + 1] = *prealloc; > > What prevents memory leak (caused by "*prealloc = NULL;") > when we hit depot_index + 1 >= STACK_ALLOC_MAX_SLABS condition? > Nice catch! We must return from this function instead of setting *prealloc to NULL.
diff --git a/lib/stackdepot.c b/lib/stackdepot.c index ed717dd08ff3..3580e92cac99 100644 --- a/lib/stackdepot.c +++ b/lib/stackdepot.c @@ -84,7 +84,9 @@ static bool init_stack_slab(void **prealloc) if (stack_slabs[depot_index] == NULL) { stack_slabs[depot_index] = *prealloc; } else { - stack_slabs[depot_index + 1] = *prealloc; + /* If this is the last depot slab, do not touch the next one. */ + if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) + stack_slabs[depot_index + 1] = *prealloc; /* * This smp_store_release pairs with smp_load_acquire() from * |next_slab_inited| above and in stack_depot_save().
Walter Wu has reported a potential case in which init_stack_slab() is called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been initialized. In that case init_stack_slab() will overwrite stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory corruption. Fixes: cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB") Reported-by: Walter Wu <walter-zh.wu@mediatek.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Matthias Brugger <matthias.bgg@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Kate Stewart <kstewart@linuxfoundation.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Alexander Potapenko <glider@google.com> --- lib/stackdepot.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)