lkml.org 
[lkml]   [2020]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] slub: Relocate freelist pointer to middle of object
From: Christopher Lameter
> Sent: 08 March 2020 19:21
>
> On Thu, 5 Mar 2020, Kees Cook wrote:
>
> > Instead of having the freelist pointer at the very beginning of an
> > allocation (offset 0) or at the very end of an allocation (effectively
> > offset -sizeof(void *) from the next allocation), move it away from
> > the edges of the allocation and into the middle. This provides some
> > protection against small-sized neighboring overflows (or underflows),
> > for which the freelist pointer is commonly the target. (Large or well
> > controlled overwrites are much more likely to attack live object contents,
> > instead of attempting freelist corruption.)
>
> Sounds good. You could even randomize the position to avoid attacks on via
> the freelist pointer.

That's a good point. "offset" is just calculated once, and for many
slabs, the available space is quite large. I wonder what the best
practice might be for how far from the edge to stay. Hmmm. Maybe simply
carve it into thirds, and randomize the offset within the middle third?

--
Kees Cook

\
 
 \ /
  Last update: 2020-03-11 18:44    [W:0.074 / U:0.276 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site