Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path

From	Christopher Lameter <cl@linux.com>
Newsgroups	linux.kernel
Subject	Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path
Date	2017-08-08 17:10 +0200
Message-ID	<uceiR-1Ly-7@gated-at.bofh.it> (permalink)
References	(1 earlier) <ubRmj-148-29@gated-at.bofh.it> <ubUka-3qL-29@gated-at.bofh.it> <ubUDw-3Ol-21@gated-at.bofh.it> <ubYnL-6B7-11@gated-at.bofh.it> <ubYH8-6KG-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, 7 Aug 2017, Kees Cook wrote:
>
> To clarify, this is desirable to kill exploitation of
> exposure-after-free flaws and some classes of use-after-free flaws,
> since the contents will have be wiped out after a free. (Verification
> of poison is nice, but is expensive compared to the benefit against
> these exploits -- and notably doesn't protect against the other
> use-after-free attacks where the contents are changed after the next
> allocation, which would have passed the poison verification.)

Well the only variable in the freed area that is in use by the allocator
is the free pointer. This ensures that complete object is poisoned and the
free pointer has a separate storage area right? So the size of the slab
objects increase. In addition to more hotpath processing we also have
increased object sizes.

I am not familiar with the terminology here.

So exposure-after-free means that the contents of the object can be used
after it was freed?

Contents are changed after allocation? Someone gets a pointer to the
object and the mods it later?

Thread

[RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Laura Abbott <labbott@redhat.com> - 2017-08-05 01:20 +0200
  Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Christopher Lameter <cl@linux.com> - 2017-08-07 16:40 +0200
    Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Laura Abbott <labbott@redhat.com> - 2017-08-07 19:50 +0200
      Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Christopher Lameter <cl@linux.com> - 2017-08-07 20:10 +0200
        Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Laura Abbott <labbott@redhat.com> - 2017-08-08 00:10 +0200
          Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Kees Cook <keescook@chromium.org> - 2017-08-08 00:30 +0200
            Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Christopher Lameter <cl@linux.com> - 2017-08-08 17:10 +0200
              Re: [RFC][PATCH] mm/slub.c: Allow poisoning to use the fast path Kees Cook <keescook@chromium.org> - 2017-08-08 21:10 +0200

csiph-web