Messages in this thread | | | Subject | Re: [v3] mm: Add SLUB free list pointer obfuscation | From | Alexander Popov <> | Date | Fri, 28 Jul 2017 01:48:56 +0300 |
| |
Hello Christopher and Kees,
On 26.07.2017 19:55, Christopher Lameter wrote: > On Wed, 26 Jul 2017, Kees Cook wrote: > >>>> What happens if, instead of BUG_ON, we do: >>>> >>>> if (unlikely(WARN_RATELIMIT(object == fp, "double-free detected")) >>>> return; >>> >>> This may work for the free fastpath but the set_freepointer function is >>> use in multiple other locations. Maybe just add this to the fastpath >>> instead of to this fucnction? >> >> Do you mean do_slab_free()? > > Yes inserting these lines into do_slab_free() would simple ignore the > double free operation in the fast path and that would be safe.
I don't really like ignoring double-free. I think, that: - it will hide dangerous bugs in the kernel, - it can make some kernel exploits more stable. I would rather add BUG_ON to set_freepointer() behind SLAB_FREELIST_HARDENED. Is it fine?
At the same time avoiding the consequences of some double-free errors is better than not doing that. It may be considered as kernel "self-healing", I don't know. I can prepare a second patch for do_slab_free(), as you described. Would you like it?
Best regards, Alexander
| |