Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751556AbdGZQzs (ORCPT ); Wed, 26 Jul 2017 12:55:48 -0400 Received: from resqmta-ch2-04v.sys.comcast.net ([69.252.207.36]:45594 "EHLO resqmta-ch2-04v.sys.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750882AbdGZQzq (ORCPT ); Wed, 26 Jul 2017 12:55:46 -0400 Date: Wed, 26 Jul 2017 11:55:44 -0500 (CDT) From: Christopher Lameter X-X-Sender: cl@nuc-kabylake To: Kees Cook cc: Alexander Popov , Andrew Morton , Pekka Enberg , David Rientjes , Joonsoo Kim , "Paul E. McKenney" , Ingo Molnar , Josh Triplett , Andy Lutomirski , Nicolas Pitre , Tejun Heo , Daniel Mack , Sebastian Andrzej Siewior , Sergey Senozhatsky , Helge Deller , Rik van Riel , Linux-MM , Tycho Andersen , LKML , "kernel-hardening@lists.openwall.com" Subject: Re: [v3] mm: Add SLUB free list pointer obfuscation In-Reply-To: Message-ID: References: <20170706002718.GA102852@beast> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-CMAE-Envelope: MS4wfO4queTxloZvolwVMjFg+pXPPRsbhXZ5R1P73Za+JProkAfv9sfRm6S4CqKNdz9ScwUuEh8BMvz9DH/g8ti2Dsrm59ig7PBMgZBHSWhRYge+Y2vGrUjy Ny+dC0/JCQ8ALdHkrq7UjlzhzJ32OlaWqNmsnOTiYgnkvZv+qd0jB61hhJat17RHngXQBOaNd3vKF6FXe9mhOzigwFD6y60BpVZXDWPTPBqWULhAn9SUmgBf rV/avxNwsiFeu4K7IXT3Vr/iVkqjyrr6eWw7NLOx0/OCCuuFBvQE0wVygf5CcPZisNXx3mAGzV+LuuEVwV/1Kp3k+REt0/7L8OVorGnRZVCPTGzhoJQZLnXY 5o7+albv1zj/NkvRYFakm3N8da+ij6fe8AFiFquUx4IFasWpXainUltLU5hdxCAHrOnDGycGLpDkGw7DAlK5HCXIAItVKlBGXjCLHfCmA7UYAIyQjTn9RrtD wsQQnJuJf0VljKDBZVT3JnOpkrEuJVaxEt+heWqL2WVfvbXu9d7VcfJIwiDLRTDW/hL8vaDfAZhnV6F8NP2IqMHcd5jqnUvfxVptJOhVt44pnunNh56d9Fys u9Lr+g+mh9a+Xabm5NNVUEUuhLT0ZCy7XHuEh6U9UMJ9mSoy4delIJemNrYJ1+jaBrL2jUjWQOO5Y3AWX+GVk6rX+FFjB+o8e46sk7IuyQgtqjekAGHOSaZH smwHM8QhTxFWkNhqPWigTM5vhbMlC0aDy9xykPx19ln3VwLNynCqQ52w6BwDRGS7grDS/okaEYeBgT0nqFCP/8Neif9L02UL Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 602 Lines: 18 On Wed, 26 Jul 2017, Kees Cook wrote: > >> What happens if, instead of BUG_ON, we do: > >> > >> if (unlikely(WARN_RATELIMIT(object == fp, "double-free detected")) > >> return; > > > > This may work for the free fastpath but the set_freepointer function is > > use in multiple other locations. Maybe just add this to the fastpath > > instead of to this fucnction? > > Do you mean do_slab_free()? Yes inserting these lines into do_slab_free() would simple ignore the double free operation in the fast path and that would be safe. Although in either case we are adding code to the fastpath...