Messages in this thread Patch in this message | | | Subject | Re: [BUG] SLOB's krealloc() seems bust | From | Matt Mackall <> | Date | Tue, 07 Oct 2008 11:37:35 -0500 |
| |
On Tue, 2008-10-07 at 18:10 +0200, Peter Zijlstra wrote: > On Tue, 2008-10-07 at 10:00 -0500, Matt Mackall wrote: > > Give this a try, please: ... > That seems to make it work again! (4 reboots, 0 crashes)
Thanks, Peter. I know we're way late in the 2.6.27 cycle, so I'll leave it to Linus and Andrew to decide how to queue this up. I'm obligated to mention it's theoretically possible that there's a path where this is exploitable, but of course only on systems where SLOB is in use.
SLOB: fix bogus ksize calculation
SLOB's ksize calculation was braindamaged and generally harmlessly underreported the allocation size. But for very small buffers, it could in fact overreport them, leading code depending on krealloc to overrun the allocation and trample other data.
Signed-off-by: Matt Mackall <mpm@selenic.com> Tested-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
diff -r 5e32b09a1b2b mm/slob.c --- a/mm/slob.c Fri Oct 03 14:04:43 2008 -0500 +++ b/mm/slob.c Tue Oct 07 11:27:47 2008 -0500 @@ -515,7 +515,7 @@ sp = (struct slob_page *)virt_to_page(block); if (slob_page(sp)) - return ((slob_t *)block - 1)->units + SLOB_UNIT; + return (((slob_t *)block - 1)->units - 1) * SLOB_UNIT; else return sp->page.private; }
-- Mathematics is the supreme nostalgia of our time.
| |