linux-kernel - Re: [PATCH] kasan: improve double-free detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+azLKpGXSqs2=7PKZLNHd61LN7FiAQeWLhw3yApVHadXQ@mail.gmail.com>
Date:	Tue, 3 May 2016 19:42:12 +0200
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	"Luruo, Kuthonuzo" <kuthonuzo.luruo@....com>
Cc:	Andrey Ryabinin <aryabinin@...tuozzo.com>,
	Alexander Potapenko <glider@...gle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	kasan-dev <kasan-dev@...glegroups.com>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] kasan: improve double-free detection

On Tue, May 3, 2016 at 9:53 AM, Luruo, Kuthonuzo
<kuthonuzo.luruo@....com> wrote:
>> I missed that Alexander already landed patches that reduce header size
>> to 16 bytes.
>> It is not OK to increase them again. Please leave state as bitfield
>> and update it with CAS (if we introduce helper functions for state
>> manipulation, they will hide the CAS loop, which is nice).
>>
>
> Available CAS primitives/compiler do not support CAS with bitfield. I propose
> to change kasan_alloc_meta to:
>
> struct kasan_alloc_meta {
>         struct kasan_track track;
>         u16 size_delta;         /* object_size - alloc size */
>         u8 state;                    /* enum kasan_state */
>         u8 reserved1;
>         u32 reserved2;
> }
>
> This shrinks _used_ meta object by 1 byte wrt the original. (btw, patch v1 does
> not increase overall alloc meta object size). "Alloc size", where needed, is
> easily calculated as a delta from cache->object_size.


What is the maximum size that slab can allocate?
I remember seeing slabs as large as 4MB some time ago (or did I
confuse it with something else?). If there are such large objects,
that 2 bytes won't be able to hold even delta.
However, now on my desktop I don't see slabs larger than 16KB in /proc/slabinfo.