Messages in this thread | | | Date | Sat, 25 Apr 2020 15:48:31 -0700 | From | Kees Cook <> | Subject | Re: [PATCH] mm/slub: do not place freelist pointer to middle of object if redzone is on |
| |
On Sat, Apr 25, 2020 at 05:13:38PM +0800, Changbin Du wrote: > The recent kernel fails to boot when slub redzone is turned on. This is > caused by commit 3202fa62fb ("slub: relocate freelist pointer to middle of > object") which relocates freelist pointer to middle of object. In this > case, get_track() gets a wrong address and then the redzone is overwritten.
Hi! A fix for this is already in -next:
https://www.ozlabs.org/~akpm/mmotm/broken-out/slub-avoid-redzone-when-choosing-freepointer-location.patch
the above doesn't disable the mitigation when using redzones, so I prefer that to this suggested solution.
-- Kees Cook
| |