redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

lkdtm: Update WRITE_AFTER_FREE test

Browse source 
The SLUB allocator may use the first word of a freed block to store the
freelist information. This may make it harder to test poisoning
features. Change the WRITE_AFTER_FREE test to better match what
the READ_AFTER_FREE test does and also print out a big more information.

Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
Laura Abbott 2016-02-25 16:36:43 -08:00 committed by Kees Cook
parent bc0b8cc6cb
commit 250a8988ef
1 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
drivers/misc/lkdtm.c
View file

@ -411,12 +411,21 @@ static void lkdtm_do_action(enum ctype which)
break;
}
case CT_WRITE_AFTER_FREE: {
int *base;
size_t len = 1024;
u32 *data = kmalloc(len, GFP_KERNEL);
/*
* The slub allocator uses the first word to store the free
* pointer in some configurations. Use the middle of the
* allocation to avoid running into the freelist
*/
size_t offset = (len / sizeof(*base)) / 2;
kfree(data);
schedule();
memset(data, 0x78, len);
base = kmalloc(len, GFP_KERNEL);
pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]);
kfree(base);
pr_info("Attempting bad write to freed memory at %p\n",
&base[offset]);
base[offset] = 0x0abcdef0;
break;
}
case CT_READ_AFTER_FREE: {