lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 6 Dec 2020 00:17:15 +0800
From:   Kuan-Ying Lee <Kuan-Ying.Lee@...iatek.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
CC:     "qiang.zhang@...driver.com" <qiang.zhang@...driver.com>,
        "sfr@...b.auug.org.au" <sfr@...b.auug.org.au>,
        "aryabinin@...tuozzo.com" <aryabinin@...tuozzo.com>,
        "dvyukov@...gle.com" <dvyukov@...gle.com>,
        "andreyknvl@...gle.com" <andreyknvl@...gle.com>,
        "qcai@...hat.com" <qcai@...hat.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        <walter-zh.wu@...iatek.com>
Subject: Re: [PATCH] kasan: fix slab double free when cpu-hotplug

On Fri, 2020-12-04 at 17:25 -0800, Andrew Morton wrote:
> On Fri, 4 Dec 2020 20:01:35 +0800 Kuan-Ying Lee <Kuan-Ying.Lee@...iatek.com> wrote:
> 
> > > diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
> > > index d98b516f372f..55783125a767 100644
> > > --- a/mm/kasan/quarantine.c
> > > +++ b/mm/kasan/quarantine.c
> > > @@ -194,7 +194,6 @@ bool quarantine_put(struct kmem_cache *cache, void *object)
> > >  
> > >  	q = this_cpu_ptr(&cpu_quarantine);
> > >  	if (q->offline) {
> > > -		qlink_free(&meta->quarantine_link, cache);
> > >  		local_irq_restore(flags);
> > >  		return false;

Hi Andrew,

Return false will cause slab allocator to free the object.
Thus, we do not need to qlink_free here to free object twice.

The return value is introduced from Andrey's patch.
"kasan: sanitize objects when metadata doesn't fit"


> > >  	}
> > 
> > Hi Qiang,
> > 
> > Thanks for fixing this.
> > Due to that issue, my commit has been removed by Stephen from
> > linux-next.
> > 
> > 
> > Hi Stephen, Andrew,
> > 
> > Should I directly upload the v4 or Stephen can pick the commit which 
> > has been removed back to the linux-next.
> 
> I took care of it.  Restored the original patch and added this one as a
> -fix.

Thanks for taking care of it.

I think there are some problem in the patch you just restored.
I saw the restored patch is not based on Andrey's patch and Stephen's
fix conflict patch.

But the issue Qiang fixed need to be based on the Andrey's patch and
Stephen's fix conflict patch.
"kasan: sanitize objects when metadata doesn't fit"
"kasan-rename-get_alloc-free_info-fix"

If the restored patch is not based on that, it may cause some problems
and conflicts.

I think I can prepare a patch v4 based on Andrey's patch, fix the
conflict and include the Qiang's modification.

Thanks,
Kuan-Ying


Powered by blists - more mailing lists