Skip to contentSkip to conversation

lib/stackdepot: fix global out-of-bounds in stack_slabs

PATCH Applied [email protected] 2 participants 2 messages Feb 18, 2020 – Feb 19, 2020

Subsystems (2)
Memory management Library code
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 lib/stackdepot: fix global out-of-bounds in stack_slabs

Walter Wu has reported a potential case in which init_stack_slab() is called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been initialized. In that case init_stack_slab() will overwrite stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory corruption.

Fixes cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
Reported-by Walter Wu <[email protected]>
Cc Dmitry Vyukov <[email protected]>
Cc Matthias Brugger <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Josh Poimboeuf <[email protected]>
Cc Kate Stewart <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc Andrew Morton <[email protected]>
Signed-off-by Alexander Potapenko <[email protected]>

---
v2:
- prevent a leak of unused preallocated stack slab (spotted by Tetsuo Handa)

---
 lib/stackdepot.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
lib/stackdepot.c +6 -2
index ed717dd08ff3..81c69c08d1d1 100644
@@ -83,15 +83,19 @@ static bool init_stack_slab(void **prealloc)
 		return true;
 	if (stack_slabs[depot_index] == NULL) {
 		stack_slabs[depot_index] = *prealloc;
+		*prealloc = NULL;
 	} else {
-		stack_slabs[depot_index + 1] = *prealloc;
+		/* If this is the last depot slab, do not touch the next one. */
+		if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) {
+			stack_slabs[depot_index + 1] = *prealloc;
+			*prealloc = NULL;
+		}
 		/*
 		 * This smp_store_release pairs with smp_load_acquire() from
 		 * |next_slab_inited| above and in stack_depot_save().
 		 */
 		smp_store_release(&next_slab_inited, 1);
 	}
-	*prealloc = NULL;
 	return true;
 }
Signature · 1 line
2.25.0.265.gbab2e86ba0-goog
maintainer
#1 lore raw
Quoted 5 lines · On Tue, 18 Feb 2020 11:29:50 +0100 [email protected] wrote:

Walter Wu has reported a potential case in which init_stack_slab() is called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been initialized. In that case init_stack_slab() will overwrite stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory corruption.

I added cc:stable to this. Please let me know it that is undesirable.