No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Dongli Zhang f459e8fc7c mm/slub.c: fix corrupted freechain in deactivate_slab()
[ Upstream commit 52f23478081ae0dcdb95d1650ea1e7d52d586829 ]

The slub_debug is able to fix the corrupted slab freelist/page.
However, alloc_debug_processing() only checks the validity of current
and next freepointer during allocation path.  As a result, once some
objects have their freepointers corrupted, deactivate_slab() may lead to
page fault.

Below is from a test kernel module when 'slub_debug=PUF,kmalloc-128
slub_nomerge'.  The test kernel corrupts the freepointer of one free
object on purpose.  Unfortunately, deactivate_slab() does not detect it
when iterating the freechain.

  BUG: unable to handle page fault for address: 00000000123456f8
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP PTI
  ... ...
  RIP: 0010:deactivate_slab.isra.92+0xed/0x490
  ... ...
  Call Trace:
   ___slab_alloc+0x536/0x570
   __slab_alloc+0x17/0x30
   __kmalloc+0x1d9/0x200
   ext4_htree_store_dirent+0x30/0xf0
   htree_dirblock_to_tree+0xcb/0x1c0
   ext4_htree_fill_tree+0x1bc/0x2d0
   ext4_readdir+0x54f/0x920
   iterate_dir+0x88/0x190
   __x64_sys_getdents+0xa6/0x140
   do_syscall_64+0x49/0x170
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

Therefore, this patch adds extra consistency check in deactivate_slab().
Once an object's freepointer is corrupted, all following objects
starting at this object are isolated.

[akpm@linux-foundation.org: fix build with CONFIG_SLAB_DEBUG=n]
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Joe Jin <joe.jin@oracle.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Link: http://lkml.kernel.org/r/20200331031450.12182-1-dongli.zhang@oracle.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-07-09 09:37:50 +02:00
arch arm64: dts: imx8mn-ddr4-evk: correct ldo1/ldo2 voltage range 2020-06-30 15:37:10 -04:00
block block: update hctx map when use multiple maps 2020-06-30 15:37:06 -04:00
certs
crypto crypto: algboss - don't wait during notifier callback 2020-06-24 17:50:51 +02:00
Documentation dt-bindings: display: mediatek: control dpi pins mode to avoid leakage 2020-06-22 09:30:58 +02:00
drivers usbnet: smsc95xx: Fix use-after-free after removal 2020-07-09 09:37:49 +02:00
fs io_uring: make sure async workqueue is canceled on exit 2020-07-09 09:37:49 +02:00
include net: qed: fix left elements count calculation 2020-06-30 15:36:58 -04:00
init x86: Fix early boot crash on gcc-10, third try 2020-05-20 08:20:34 +02:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:20:16 +02:00
kernel sched/debug: Make sd->flags sysctl read-only 2020-07-09 09:37:50 +02:00
lib test_objagg: Fix potential memory leak in error handling 2020-06-30 15:37:04 -04:00
LICENSES
mm mm/slub.c: fix corrupted freechain in deactivate_slab() 2020-07-09 09:37:50 +02:00
net xprtrdma: Fix handling of RDMA_ERROR replies 2020-06-30 15:37:12 -04:00
samples bpf, xdp, samples: Fix null pointer dereference in *_user code 2020-06-30 15:36:55 -04:00
scripts recordmcount: support >64k sections 2020-06-30 15:37:05 -04:00
security selinux: fix double free 2020-06-24 17:50:48 +02:00
sound ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems 2020-06-30 15:37:06 -04:00
tools selftests/net: report etf errors correctly 2020-06-30 15:36:58 -04:00
usr initramfs: restore default compression behavior 2020-04-08 09:08:38 +02:00
virt KVM: arm64: Save the host's PtrAuth keys in non-preemptible context 2020-06-17 16:40:38 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Modules updates for v5.4 2019-09-22 10:34:46 -07:00
.mailmap ARM: SoC fixes 2019-11-10 13:41:59 -08:00
COPYING
CREDITS MAINTAINERS: Remove Simon as Renesas SoC Co-Maintainer 2019-10-10 08:12:51 -07:00
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: Update drm/i915 bug filing URL 2020-02-28 17:22:19 +01:00
Makefile Linux 5.4.50 2020-06-30 16:21:55 -04:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.