linux-kernel - Re: [PATCH] mm, slub: fix uninitialized variable in __slab

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 16 Dec 2022 16:42:32 +0900
From:   Hyeonggon Yoo <42.hyeyoo@...il.com>
To:     Chen Jun <chenjun102@...wei.com>
Cc:     cl@...ux.com, penberg@...nel.org, rientjes@...gle.com,
        iamjoonsoo.kim@....com, akpm@...ux-foundation.org, vbabka@...e.cz,
        roman.gushchin@...ux.dev, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, xuqiang36@...wei.com
Subject: Re: [PATCH] mm, slub: fix uninitialized variable in __slab_free

On Fri, Dec 16, 2022 at 03:31:19AM +0000, Chen Jun wrote:
> new.frozen is not initialized before it is used.
> 
> Fixes: 2cfb7455d223 ("slub: Rework allocator fastpaths")
> Signed-off-by: Chen Jun <chenjun102@...wei.com>
> ---
>  mm/slub.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 13459c69095a..8628c88875b6 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -3593,6 +3593,7 @@ static void __slab_free(struct kmem_cache *s, struct slab *slab,
>  		return;
>  	}
>  
> +	new.frozen = 0;
>  	do {
>  		if (unlikely(n)) {
>  			spin_unlock_irqrestore(&n->list_lock, flags);
> -- 
> 2.17.1

This is incorrect because new.frozen is initialized when new.counters is
initialized.

See definition of struct slab in mm/slab.h:

struct slab {

	[...]
	union {
		unsigned long counters;
		struct {
			unsigned inuse:16;
			unsigned objects:15;
			unsigned frozen:1;
		};
	};
}

-- 
Thanks,
Hyeonggon