lkml.org 
[lkml]   [2019]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] lkdtm: fix potential use after free
    Hi,

    On Wed, Apr 24, 2019 at 05:59:52PM +0800, Weikang shi wrote:
    > From: swkhack <swkhack@gmail.com>
    >
    > The function lkdtm_READ_AFTER_FREE calls kfree(base) to free the memory
    > of base. However, following kfree(base),
    > it access the memory which base point to via base[offset]. This may result in a
    > use-after-free bug.

    This is deliberate; the test is designed to provoke a use-after-free to
    verify that this can be detected by tools such as KASAN.

    > This patch moves kfree(base) after the dereference.

    Doing this would break the test, so we should not make this change.

    Was this something you spotted with a static analysis tool?

    > Signed-off-by: swkhack <swkhack@gmail.com>

    A signed-off-by line should have your real name rather than an alias.

    Thanks,
    Mark.

    > ---
    > drivers/misc/lkdtm/heap.c | 2 +-
    > 1 file changed, 1 insertion(+), 1 deletion(-)
    >
    > diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c
    > index 65026d7de..3e2f1580a 100644
    > --- a/drivers/misc/lkdtm/heap.c
    > +++ b/drivers/misc/lkdtm/heap.c
    > @@ -77,7 +77,6 @@ void lkdtm_READ_AFTER_FREE(void)
    > base[offset] = *val;
    > pr_info("Value in memory before free: %x\n", base[offset]);
    >
    > - kfree(base);
    >
    > pr_info("Attempting bad read from freed memory\n");
    > saw = base[offset];
    > @@ -88,6 +87,7 @@ void lkdtm_READ_AFTER_FREE(void)
    > }
    > pr_info("Memory was not poisoned\n");
    >
    > + kfree(base);
    > kfree(val);
    > }
    >
    > --
    > 2.17.1
    >

    \
     
     \ /
      Last update: 2019-04-24 14:24    [W:5.310 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site