The redzone area for SLUB exists between s->object_size and s->inuse
(which is at least the word-aligned object size). If a cache were created
with an object_size smaller than sizeof(void *), the in-object stored
freelist pointer will be overwritten by redzoning (e.g. with boot param
"slub_debug=ZV"):
BUG test (Tainted: G B ): Right Redzone overwritten
-----------------------------------------------------------------------------
INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb
INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200
INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620
Redzone (____ptrval____): bb bb bb bb bb bb bb bb ........
Object (____ptrval____): f6 f4 a5 40 1d e8 ...@..
Redzone (____ptrval____): 1a aa ..
Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........
Store the freelist pointer out of line when object_size is smaller than
sizeof(void *) and redzoning is enabled.
(Note that no caches with such a size are known to exist in the kernel
currently.)
Fixes: 81819f0fc828 ("SLUB core")
Cc: [email protected]
Signed-off-by: Kees Cook <[email protected]>
---
mm/slub.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index f4f1d63f0ab9..752fad36522c 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3682,15 +3682,17 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
*/
s->inuse = size;
- if (((flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)) ||
- s->ctor)) {
+ if ((flags & (SLAB_TYPESAFE_BY_RCU | SLAB_POISON)) ||
+ ((flags & SLAB_RED_ZONE) && s->object_size < sizeof(void *)) ||
+ s->ctor) {
/*
* Relocate free pointer after the object if it is not
* permitted to overwrite the first word of the object on
* kmem_cache_free.
*
* This is the case if we do RCU, have a constructor or
- * destructor or are poisoning the objects.
+ * destructor, are poisoning the objects, or are
+ * redzoning an object smaller than sizeof(void *).
*
* The assumption that s->offset >= s->inuse means free
* pointer is outside of the object is used in the
--
2.25.1
On Fri, 9 Oct 2020, Kees Cook wrote:
> Store the freelist pointer out of line when object_size is smaller than
> sizeof(void *) and redzoning is enabled.
>
> (Note that no caches with such a size are known to exist in the kernel
> currently.)
Ummm... The smallest allowable cache size is sizeof(void *) as I recall.
mm/slab_common.c::kmem_sanity_check() checks the sizes when caches are
created.
NAK.
On Mon, Oct 12, 2020 at 08:01:04AM +0000, Christopher Lameter wrote:
> On Fri, 9 Oct 2020, Kees Cook wrote:
>
> > Store the freelist pointer out of line when object_size is smaller than
> > sizeof(void *) and redzoning is enabled.
> >
> > (Note that no caches with such a size are known to exist in the kernel
> > currently.)
>
> Ummm... The smallest allowable cache size is sizeof(void *) as I recall.
>
>
> mm/slab_common.c::kmem_sanity_check() checks the sizes when caches are
> created.
Ah thank you! Yes, I really thought there was a place where that
happened, but I missed it. This patch can be dropped.
--
Kees Cook