linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-06 05:27:07 +02:00

Linux kernel source tree

Go to file

Kees Cook f6ed235754 mm/slub: actually fix freelist pointer vs redzoning commit `e41a49fadb` upstream. It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer), so a cache created with an object size less than 24 would have the freelist pointer written beyond s->object_size, causing the redzone to be corrupted by the freelist pointer. This was very visible with "slub_debug=ZF": BUG test (Tainted: G B ): Right Redzone overwritten ----------------------------------------------------------------------------- INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200 INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620 Redzone (____ptrval____): bb bb bb bb bb bb bb bb ........ Object (____ptrval____): 00 00 00 00 00 f6 f4 a5 ........ Redzone (____ptrval____): 40 1d e8 1a aa @.... Padding (____ptrval____): 00 00 00 00 00 00 00 00 ........ Adjust the offset to stay within s->object_size. (Note that no caches of in this size range are known to exist in the kernel currently.) Link: https://lkml.kernel.org/r/20210608183955.280836-4-keescook@chromium.org Link: https://lore.kernel.org/linux-mm/20200807160627.GA1420741@elver.google.com/ Link: https://lore.kernel.org/lkml/0f7dd7b2-7496-5e2d-9488-2ec9f8e90441@suse.cz/Fixes: `89b83f282d` (slub: avoid redzone when choosing freepointer location) Link: https://lore.kernel.org/lkml/CANpmjNOwZ5VpKQn+SYWovTkFB4VsT-RPwyENBmaK0dLcpqStkA@mail.gmail.com Signed-off-by: Kees Cook <keescook@chromium.org> Reported-by: Marco Elver <elver@google.com> Reported-by: "Lin, Zhenpeng" <zplin@psu.edu> Tested-by: Marco Elver <elver@google.com> Acked-by: Vlastimil Babka <vbabka@suse.cz> Cc: Christoph Lameter <cl@linux.com> Cc: David Rientjes <rientjes@google.com> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: Pekka Enberg <penberg@kernel.org> Cc: Roman Gushchin <guro@fb.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-06-23 14:42:54 +02:00
arch	x86/fpu: Reset state for all signal restore failures	2021-06-23 14:42:52 +02:00
block	blk-mq: Swap two calls in blk_mq_exit_queue()	2021-05-19 10:13:14 +02:00
certs	certs: Fix blacklist flag type confusion	2021-03-04 11:37:59 +01:00
crypto	async_xor: check src_offs is not NULL before updating it	2021-06-16 12:01:40 +02:00
Documentation	mm/slub: clarify verification reporting	2021-06-23 14:42:53 +02:00
drivers	net: ll_temac: Fix TX BD buffer overwrite	2021-06-23 14:42:53 +02:00
fs	fanotify: fix copy_event_to_user() fid error clean up	2021-06-23 14:42:41 +02:00
include	mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare	2021-06-23 14:42:53 +02:00
init	pid: take a reference when initializing `cad_pid`	2021-06-10 13:39:26 +02:00
ipc	ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry	2021-05-26 12:06:54 +02:00
kernel	crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo	2021-06-23 14:42:52 +02:00
lib	lib/lz4: explicitly support in-place decompression	2021-06-10 13:39:29 +02:00
LICENSES	LICENSES/deprecated: add Zlib license text	2020-09-16 14:33:49 +02:00
mm	mm/slub: actually fix freelist pointer vs redzoning	2021-06-23 14:42:54 +02:00
net	net: bridge: fix vlan tunnel dst refcnt when egressing	2021-06-23 14:42:53 +02:00
samples	samples: vfio-mdev: fix error handing in mdpy_fb_probe()	2021-06-10 13:39:15 +02:00
scripts	scripts/clang-tools: switch explicitly to Python 3	2021-06-03 09:00:52 +02:00
security	KEYS: trusted: Fix memory leak on object td	2021-05-19 10:12:50 +02:00
sound	ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin	2021-06-23 14:42:49 +02:00
tools	ipv4: Fix device used for dst_alloc with local routes	2021-06-23 14:42:45 +02:00
usr	Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-08-07 13:29:39 -07:00
virt	Revert "irqbypass: do not start cons/prod when failed connect"	2021-06-03 09:00:34 +02:00
.clang-format	RDMA 5.10 pull request	2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
.mailmap	mailmap: add two more addresses of Uwe Kleine-König	2020-12-06 10:19:07 -08:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Jason Cooper to CREDITS	2020-11-30 10:20:34 +01:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	f2fs: move ioctl interface definitions to separated file	2021-05-19 10:13:00 +02:00
Makefile	Linux 5.10.45	2021-06-18 10:00:06 +02:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.