linux-kernel - [PATCH v4 0/2] KASAN double-free detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 29 May 2016 21:40:24 +0530
From:	Kuthonuzo Luruo <kuthonuzo.luruo@....com>
To:	aryabinin@...tuozzo.com, glider@...gle.com, dvyukov@...gle.com,
	cl@...ux.com, penberg@...nel.org, rientjes@...gle.com,
	iamjoonsoo.kim@....com, akpm@...ux-foundation.org
Cc:	kasan-dev@...glegroups.com, linux-kernel@...r.kernel.org,
	ynorov@...iumnetworks.com, kuthonuzo.luruo@....com
Subject: [PATCH v4 0/2] KASAN double-free detection

Submitting v4 for your review/consideration. First patch provides more
reliable double-free detection for KASAN. Second patch provides new
double-free tests for 'test_kasan'.

"Lock break" on out-of-bounds (OOB) write detection in patch v3 suffers
from one fatal flaw: it's not possible to distinguish between when lock bit
is set because a holder exists or because it got flipped by OOB.

Patch v4 (this patch) solves the issue by exploiting header shadow memory
for storing the per-object header lock bit. This makes locking more
resilient even in the presence of OOB writes on header.

v3 link: https://lkml.org/lkml/2016/5/24/577

Patchset is based on linux-next 'next-20160527'.

Kuthonuzo Luruo (2):
  mm, kasan: improve double-free detection
  kasan: add double-free tests

 include/linux/kasan.h |    7 ++-
 lib/test_kasan.c      |   47 ++++++++++++++++++
 mm/kasan/kasan.c      |  125 ++++++++++++++++++++++++++++++++++++++-----------
 mm/kasan/kasan.h      |   24 +++++++++-
 mm/kasan/quarantine.c |    4 +-
 mm/kasan/report.c     |   24 +++++++++-
 mm/slab.c             |    3 +-
 mm/slub.c             |    2 +-
 8 files changed, 200 insertions(+), 36 deletions(-)