linux-kernel - Re: [PATCH] kasan: fix slab double free when cpu-hotplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1607185035.22062.42.camel@mtksdccf07>
Date:   Sun, 6 Dec 2020 00:17:15 +0800
From:   Kuan-Ying Lee <Kuan-Ying.Lee@...iatek.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
CC:     "qiang.zhang@...driver.com" <qiang.zhang@...driver.com>,
        "sfr@...b.auug.org.au" <sfr@...b.auug.org.au>,
        "aryabinin@...tuozzo.com" <aryabinin@...tuozzo.com>,
        "dvyukov@...gle.com" <dvyukov@...gle.com>,
        "andreyknvl@...gle.com" <andreyknvl@...gle.com>,
        "qcai@...hat.com" <qcai@...hat.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        <walter-zh.wu@...iatek.com>
Subject: Re: [PATCH] kasan: fix slab double free when cpu-hotplug

On Fri, 2020-12-04 at 17:25 -0800, Andrew Morton wrote:
> On Fri, 4 Dec 2020 20:01:35 +0800 Kuan-Ying Lee <Kuan-Ying.Lee@...iatek.com> wrote:
> 
> > > diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
> > > index d98b516f372f..55783125a767 100644
> > > --- a/mm/kasan/quarantine.c
> > > +++ b/mm/kasan/quarantine.c
> > > @@ -194,7 +194,6 @@ bool quarantine_put(struct kmem_cache *cache, void *object)
> > >  
> > >  	q = this_cpu_ptr(&cpu_quarantine);
> > >  	if (q->offline) {
> > > -		qlink_free(&meta->quarantine_link, cache);
> > >  		local_irq_restore(flags);
> > >  		return false;

Hi Andrew,

Return false will cause slab allocator to free the object.
Thus, we do not need to qlink_free here to free object twice.

The return value is introduced from Andrey's patch.
"kasan: sanitize objects when metadata doesn't fit"

> > >  	}
> > 
> > Hi Qiang,
> > 
> > Thanks for fixing this.
> > Due to that issue, my commit has been removed by Stephen from
> > linux-next.
> > 
> > 
> > Hi Stephen, Andrew,
> > 
> > Should I directly upload the v4 or Stephen can pick the commit which 
> > has been removed back to the linux-next.
> 
> I took care of it.  Restored the original patch and added this one as a
> -fix.

Thanks for taking care of it.

I think there are some problem in the patch you just restored.
I saw the restored patch is not based on Andrey's patch and Stephen's
fix conflict patch.

But the issue Qiang fixed need to be based on the Andrey's patch and
Stephen's fix conflict patch.
"kasan: sanitize objects when metadata doesn't fit"
"kasan-rename-get_alloc-free_info-fix"

If the restored patch is not based on that, it may cause some problems
and conflicts.

I think I can prepare a patch v4 based on Andrey's patch, fix the
conflict and include the Qiang's modification.

Thanks,
Kuan-Ying