From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752970AbcBZAgw (ORCPT ); Thu, 25 Feb 2016 19:36:52 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34919 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752299AbcBZAgu (ORCPT ); Thu, 25 Feb 2016 19:36:50 -0500 From: Laura Abbott To: Arnd Bergmann , Greg Kroah-Hartman , Kees Cook Cc: Laura Abbott , linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH 2/3] lkdtm: Update WRITE_AFTER_FREE test Date: Thu, 25 Feb 2016 16:36:43 -0800 Message-Id: <1456447004-21392-3-git-send-email-labbott@fedoraproject.org> In-Reply-To: <1456447004-21392-1-git-send-email-labbott@fedoraproject.org> References: <1456447004-21392-1-git-send-email-labbott@fedoraproject.org> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Fri, 26 Feb 2016 00:36:49 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The SLUB allocator may use the first word of a freed block to store the freelist information. This may make it harder to test poisoning features. Change the WRITE_AFTER_FREE test to better match what the READ_AFTER_FREE test does and also print out a big more information. Signed-off-by: Kees Cook Signed-off-by: Laura Abbott --- drivers/misc/lkdtm.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 8de4746..a00a2b1 100644 --- a/drivers/misc/lkdtm.c +++ b/drivers/misc/lkdtm.c @@ -411,12 +411,21 @@ static void lkdtm_do_action(enum ctype which) break; } case CT_WRITE_AFTER_FREE: { + int *base; size_t len = 1024; - u32 *data = kmalloc(len, GFP_KERNEL); + /* + * The slub allocator uses the first word to store the free + * pointer in some configurations. Use the middle of the + * allocation to avoid running into the freelist + */ + size_t offset = (len / sizeof(*base)) / 2; - kfree(data); - schedule(); - memset(data, 0x78, len); + base = kmalloc(len, GFP_KERNEL); + pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]); + kfree(base); + pr_info("Attempting bad write to freed memory at %p\n", + &base[offset]); + base[offset] = 0x0abcdef0; break; } case CT_READ_AFTER_FREE: { -- 2.5.0