Messages in this thread | | | Date | Wed, 9 Dec 2015 14:12:20 -0800 | From | Brian Norris <> | Subject | Re: [PATCH 2/4] test: firmware_class: add asynchronous request trigger |
| |
On Wed, Dec 09, 2015 at 02:05:17PM -0800, Kees Cook wrote: > On Wed, Dec 9, 2015 at 1:48 PM, Brian Norris > <computersforpeace@gmail.com> wrote: > > I was also thinking, since use-after-free isn't necessarily immediately > > obvious (this worked fine in my testing), that maybe we could poison the > > buffer before kfree()'ing? Like: > > > > name = ...; > > len = strlen(name); > > > > ... > > > > rc = request_firmware_nowait(...); > > if (rc) { > > pr_info("..."); > > kfree(name); > > goto out; > > } > > /* > > * Clear out the name, to test for race conditions with the > > * async request > > */ > > memset(name, 0, len); > > kfree(name); > > Hrm, well, I'm not against it, but I think running under KASan is > probably the right way to find these things. But, might as well, just > to notice any regressions.
Fair enough. The memset probably isn't that useful.
BTW, one reason I didn't notice my use-after-free is that the "use" was under an error path that I didn't exercise. I need to remember to turn my brain back on.
Brian
| |