lkml.org 
[lkml]   [2020]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 068/135] lib/stackdepot.c: fix global out-of-bounds in stack_slabs
    Date
    From: Alexander Potapenko <glider@google.com>

    commit 305e519ce48e935702c32241f07d393c3c8fed3e upstream.

    Walter Wu has reported a potential case in which init_stack_slab() is
    called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been
    initialized. In that case init_stack_slab() will overwrite
    stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory
    corruption.

    Link: http://lkml.kernel.org/r/20200218102950.260263-1-glider@google.com
    Fixes: cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
    Signed-off-by: Alexander Potapenko <glider@google.com>
    Reported-by: Walter Wu <walter-zh.wu@mediatek.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Matthias Brugger <matthias.bgg@gmail.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Kate Stewart <kstewart@linuxfoundation.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    lib/stackdepot.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    --- a/lib/stackdepot.c
    +++ b/lib/stackdepot.c
    @@ -83,15 +83,19 @@ static bool init_stack_slab(void **preal
    return true;
    if (stack_slabs[depot_index] == NULL) {
    stack_slabs[depot_index] = *prealloc;
    + *prealloc = NULL;
    } else {
    - stack_slabs[depot_index + 1] = *prealloc;
    + /* If this is the last depot slab, do not touch the next one. */
    + if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) {
    + stack_slabs[depot_index + 1] = *prealloc;
    + *prealloc = NULL;
    + }
    /*
    * This smp_store_release pairs with smp_load_acquire() from
    * |next_slab_inited| above and in stack_depot_save().
    */
    smp_store_release(&next_slab_inited, 1);
    }
    - *prealloc = NULL;
    return true;
    }


    \
     
     \ /
      Last update: 2020-02-27 15:26    [W:4.092 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site