lkml.org 
[lkml]   [2008]   [Oct]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [BUG] SLOB's krealloc() seems bust
From
Date

On Tue, 2008-10-07 at 18:10 +0200, Peter Zijlstra wrote:
> On Tue, 2008-10-07 at 10:00 -0500, Matt Mackall wrote:
> > Give this a try, please:
...
> That seems to make it work again! (4 reboots, 0 crashes)

Thanks, Peter. I know we're way late in the 2.6.27 cycle, so I'll leave
it to Linus and Andrew to decide how to queue this up. I'm obligated to
mention it's theoretically possible that there's a path where this is
exploitable, but of course only on systems where SLOB is in use.


SLOB: fix bogus ksize calculation

SLOB's ksize calculation was braindamaged and generally harmlessly
underreported the allocation size. But for very small buffers, it could
in fact overreport them, leading code depending on krealloc to overrun
the allocation and trample other data.

Signed-off-by: Matt Mackall <mpm@selenic.com>
Tested-by: Peter Zijlstra <a.p.zijlstra@chello.nl>

diff -r 5e32b09a1b2b mm/slob.c
--- a/mm/slob.c Fri Oct 03 14:04:43 2008 -0500
+++ b/mm/slob.c Tue Oct 07 11:27:47 2008 -0500
@@ -515,7 +515,7 @@

sp = (struct slob_page *)virt_to_page(block);
if (slob_page(sp))
- return ((slob_t *)block - 1)->units + SLOB_UNIT;
+ return (((slob_t *)block - 1)->units - 1) * SLOB_UNIT;
else
return sp->page.private;
}




--
Mathematics is the supreme nostalgia of our time.



\
 
 \ /
  Last update: 2008-10-07 18:45    [W:0.079 / U:1.560 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site