From patchwork Mon Aug 10 15:19:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 266703 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B364C433DF for ; Mon, 10 Aug 2020 15:21:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C5A8D20734 for ; Mon, 10 Aug 2020 15:21:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597072889; bh=HcBNhSb0GmByQS2frDJPr/p9ayMXKaZQ4dRvzizDfvM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=vc7azkCKxtzPRbIFoY15uPJDaI1GcpGdsbvFJhfNhMQz5FObreRPVRFk1grz9LMFQ B9jTlcx/ltAQONEEfV6yyvCFtH7uRFTFP/74jrW/G1830i4pTOAe+Vh59Kpu353Z63 DQoVDiFD9QYfwbTBqKYSl0qxuA4FOe8VT56BDwkY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728092AbgHJPU5 (ORCPT ); Mon, 10 Aug 2020 11:20:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:51640 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728071AbgHJPU4 (ORCPT ); Mon, 10 Aug 2020 11:20:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8869C20782; Mon, 10 Aug 2020 15:20:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597072856; bh=HcBNhSb0GmByQS2frDJPr/p9ayMXKaZQ4dRvzizDfvM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Moq+0hU+GyI4IXSfB+eWpEnCc2az7kBVMuQfabfNZEk6G+WxldifS+EC+NwBX+uzN Co0PQfn0Uq5qp0o7A3tSUldlND/qGyg23GdVYAQ10Qz5BL4wTnuDl1iFzOkNtjrlNO C2Up9vn4n4atu272q6nA33SRsPTMycTR7eJu2WDY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook Subject: [PATCH 5.8 22/38] lkdtm/heap: Avoid edge and middle of slabs Date: Mon, 10 Aug 2020 17:19:12 +0200 Message-Id: <20200810151804.989498491@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200810151803.920113428@linuxfoundation.org> References: <20200810151803.920113428@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kees Cook commit e12145cf1c3a8077e6d9f575711e38dd7d8a3ebc upstream. Har har, after I moved the slab freelist pointer into the middle of the slab, now it looks like the contents are getting poisoned. Adjust the test to avoid the freelist pointer again. Fixes: 3202fa62fb43 ("slub: relocate freelist pointer to middle of object") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20200625203704.317097-3-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman --- drivers/misc/lkdtm/heap.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/misc/lkdtm/heap.c +++ b/drivers/misc/lkdtm/heap.c @@ -58,11 +58,12 @@ void lkdtm_READ_AFTER_FREE(void) int *base, *val, saw; size_t len = 1024; /* - * The slub allocator uses the first word to store the free - * pointer in some configurations. Use the middle of the - * allocation to avoid running into the freelist + * The slub allocator will use the either the first word or + * the middle of the allocation to store the free pointer, + * depending on configurations. Store in the second word to + * avoid running into the freelist. */ - size_t offset = (len / sizeof(*base)) / 2; + size_t offset = sizeof(*base); base = kmalloc(len, GFP_KERNEL); if (!base) {