Alexander Popov ce6fa91b93 mm/slub.c: add a naive detection of double free or corruption ...

Add an assertion similar to "fasttop" check in GNU C Library allocator
as a part of SLAB_FREELIST_HARDENED feature.  An object added to a
singly linked freelist should not point to itself.  That helps to detect
some double free errors (e.g. CVE-2017-2636) without slub_debug and
KASAN.

Link: http://lkml.kernel.org/r/1502468246-1262-1-git-send-email-alex.popov@linux.com
Signed-off-by: Alexander Popov <alex.popov@linux.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Paul E McKenney <paulmck@linux.vnet.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tycho Andersen <tycho@docker.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2017-09-06 17:27:24 -07:00

..

kasan

Merge branch 'linus' into locking/core, to pick up fixes

2017-08-10 12:20:53 +02:00

backing-dev.c

bdi: Drop 'parent' argument from bdi_register[_va]()

2017-04-20 12:09:55 -06:00

balloon_compaction.c

mm/balloon_compaction.c: don't zero ballooned pages

2017-08-10 15:54:07 -07:00

bootmem.c

mm/bootmem.c: cosmetic improvement of code readability

2017-02-22 16:41:29 -08:00

cleancache.c

fs: switch ->s_uuid to uuid_t

2017-06-05 16:59:12 +02:00

cma_debug.c

mm/cma_debug.c: fix stack corruption due to sprintf usage

2017-08-18 15:32:02 -07:00

cma.c

cma: fix calculation of aligned offset

2017-07-10 16:32:32 -07:00

cma.h

cma: Store a name in the cma structure

2017-04-18 20:41:12 +02:00

compaction.c

mm, compaction: skip over holes in __reset_isolation_suitable

2017-07-06 16:24:32 -07:00

debug_page_ref.c

mm/page_ref: add tracepoint to track down page reference manipulation

2016-03-17 15:09:34 -07:00

debug.c

mm: make tlb_flush_pending global

2017-08-10 15:54:07 -07:00

dmapool.c

lib/vsprintf.c: remove %Z support

2017-02-27 18:43:47 -08:00

early_ioremap.c

x86/mm: Add support to access boot related data in the clear

2017-07-18 11:38:02 +02:00

fadvise.c

mm: fadvise: avoid expensive remote LRU cache draining after FADV_DONTNEED

2016-12-20 09:48:46 -08:00

failslab.c

mm: fault-inject take over bootstrap kmem_cache check

2016-03-15 16:55:16 -07:00

filemap.c

dax: remove DAX code from page_cache_tree_insert()

2017-09-06 17:27:24 -07:00

frame_vector.c

treewide: use kv[mz]alloc* rather than opencoded variants

2017-05-08 17:15:13 -07:00

frontswap.c

mm, frontswap: convert frontswap_enabled to static key

2016-07-26 16:19:19 -07:00

gup.c

mm, gup: ensure real head page is ref-counted when using hugepages

2017-07-06 16:24:34 -07:00

highmem.c

mm/highmem: make nr_free_highpages() handles all highmem zones by itself

2016-05-19 19:12:14 -07:00

huge_memory.c

Merge branch 'linus' into locking/core, to pick up fixes

2017-08-25 11:04:51 +02:00

hugetlb_cgroup.c

mm, hugetlb_cgroup: round limit_in_bytes down to hugepage size

2016-05-20 17:58:30 -07:00

hugetlb.c

userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case

2017-08-10 15:54:06 -07:00

hwpoison-inject.c

mm: hwpoison: call shake_page() unconditionally

2017-05-03 15:52:12 -07:00

init-mm.c

mm: Add a user_ns owner to mm_struct and fix ptrace permission checks

2016-11-22 11:49:48 -06:00

internal.h

mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries

2017-08-02 16:34:46 -07:00

interval_tree.c

…

Kconfig

mm/kasan: add support for memory hotplug

2017-07-10 16:32:33 -07:00

Kconfig.debug

mm: enable page poisoning early at boot

2017-05-03 15:52:10 -07:00

khugepaged.c

mm: make PR_SET_THP_DISABLE immediately active

2017-07-10 16:32:31 -07:00

kmemcheck.c

mm: Rename SLAB_DESTROY_BY_RCU to SLAB_TYPESAFE_BY_RCU

2017-04-18 11:42:36 -07:00

kmemleak-test.c

mm: convert printk(KERN_<LEVEL> to pr_<level>

2016-03-17 15:09:34 -07:00

kmemleak.c

mm: kmemleak: treat vm_struct as alternative reference to vmalloc'ed objects

2017-07-06 16:24:34 -07:00

ksm.c

mm: fix KSM data corruption

2017-08-10 15:54:07 -07:00

list_lru.c

mm/list_lru.c: fix list_lru_count_node() to be race free

2017-07-10 16:32:33 -07:00

maccess.c

x86: remove more uaccess_32.h complexity

2016-05-22 17:21:27 -07:00

madvise.c

mm, madvise: ensure poisoned pages are removed from per-cpu lists

2017-08-31 16:33:15 -07:00

Makefile

percpu: expose statistics about percpu memory via debugfs

2017-06-20 15:31:38 -04:00

memblock.c

mm/memblock.c: reversed logic in memblock_discard()

2017-08-25 16:12:46 -07:00

memcontrol.c

mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()

2017-08-18 15:32:01 -07:00

memory_hotplug.c

mm/memory-hotplug: switch locking to a percpu rwsem

2017-07-10 16:32:33 -07:00

memory-failure.c

x86/mm, mm/hwpoison: Clear PRESENT bit for kernel 1:1 mappings of poison pages

2017-08-17 10:30:49 +02:00

memory.c

mm: add vm_insert_mixed_mkwrite()

2017-09-06 17:27:24 -07:00

mempolicy.c

mm/mempolicy: fix use after free when calling get_mempolicy

2017-08-18 15:32:02 -07:00

mempool.c

sched/wait: Rename wait_queue_t => wait_queue_entry_t

2017-06-20 12:18:27 +02:00

memtest.c

memtest: remove unused header files

2015-09-08 15:35:28 -07:00

migrate.c

Sanitize 'move_pages()' permission checks

2017-08-20 13:26:27 -07:00

mincore.c

mm: remove shmem_mapping() shmem_zero_setup() duplicates

2017-02-24 17:46:56 -08:00

mlock.c

mlock: fix mlock count can not decrease in race condition

2017-06-02 15:07:38 -07:00

mm_init.c

mm: convert printk(KERN_<LEVEL> to pr_<level>

2016-03-17 15:09:34 -07:00

mmap.c

mm: fix overflow check in expand_upwards()

2017-07-14 15:05:12 -07:00

mmu_context.c

sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>

2017-03-02 08:42:38 +01:00

mmu_notifier.c

mm/mmu_notifier: kill invalidate_page

2017-08-31 16:13:00 -07:00

mmzone.c

mm/mmzone.c: swap likely to unlikely as code logic is different for next_zones_zonelist()

2017-02-22 16:41:29 -08:00

mprotect.c

mm: migrate: prevent racy access to tlb_flush_pending

2017-08-10 15:54:07 -07:00

mremap.c

userfaultfd: non-cooperative: notify about unmap of destination during mremap

2017-08-02 16:34:46 -07:00

msync.c

mm/msync: use offset_in_page macro

2015-11-05 19:34:48 -08:00

nobootmem.c

mm: discard memblock data later

2017-08-18 15:32:01 -07:00

nommu.c

mm, vmalloc: use __GFP_HIGHMEM implicitly

2017-05-08 17:15:13 -07:00

oom_kill.c

mm/oom_kill.c: add tracepoints for oom reaper-related events

2017-07-10 16:32:32 -07:00

page_alloc.c

Merge branch 'linus' into locking/core, to fix up conflicts

2017-09-04 11:01:18 +02:00

page_counter.c

mm: page_counter: let page_counter_try_charge() return bool

2015-11-05 19:34:48 -08:00

page_ext.c

mm: enable page poisoning early at boot

2017-05-03 15:52:10 -07:00

page_idle.c

mm: make rmap_one boolean function

2017-05-03 15:52:10 -07:00

page_io.c

mm/page_io.c: fix oops during block io poll in swapin path

2017-08-02 17:16:11 -07:00

page_isolation.c

mm: unify new_node_page and alloc_migrate_target

2017-07-10 16:32:31 -07:00

page_owner.c

mm: avoid taking zone lock in pagetypeinfo_showmixed()

2017-07-10 16:32:32 -07:00

page_poison.c

mm: enable page poisoning early at boot

2017-05-03 15:52:10 -07:00

page_vma_mapped.c

mm/hugetlb: add size parameter to huge_pte_offset()

2017-07-06 16:24:34 -07:00

page-writeback.c

mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()

2017-08-18 15:32:01 -07:00

pagewalk.c

mm/hugetlb: add size parameter to huge_pte_offset()

2017-07-06 16:24:34 -07:00

percpu-internal.h

percpu: fix early calls for spinlock in pcpu_stats

2017-06-21 13:53:52 -04:00

percpu-km.c

percpu: fix static checker warnings in pcpu_destroy_chunk

2017-06-29 11:23:38 -04:00

percpu-stats.c

percpu: expose statistics about percpu memory via debugfs

2017-06-20 15:31:38 -04:00

percpu-vm.c

percpu: fix static checker warnings in pcpu_destroy_chunk

2017-06-29 11:23:38 -04:00

percpu.c

percpu: resolve err may not be initialized in pcpu_alloc

2017-06-21 12:00:45 -04:00

pgtable-generic.c

mm: convert generic code to 5-level paging

2017-03-09 11:48:47 -08:00

process_vm_access.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/mm.h>

2017-03-02 08:42:28 +01:00

quicklist.c

fix Christoph's email addresses

2016-03-17 15:09:34 -07:00

readahead.c

mm: don't cap request size based on read-ahead setting

2016-12-12 18:55:08 -08:00

rmap.c

mm/rmap: update to new mmu_notifier semantic v2

2017-08-31 16:12:59 -07:00

rodata_test.c

mm: remove rodata_test_data export, add pr_fmt

2017-05-03 15:52:09 -07:00

shmem.c

mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled

2017-08-25 16:12:46 -07:00

slab_common.c

mm: allow slab_nomerge to be set at build time

2017-07-06 16:24:31 -07:00

slab.c

mm: memcontrol: account slab stats per lruvec

2017-07-06 16:24:35 -07:00

slab.h

locking/lockdep: Rework FS_RECLAIM annotation

2017-08-10 12:29:03 +02:00

slob.c

locking/lockdep: Rework FS_RECLAIM annotation

2017-08-10 12:29:03 +02:00

slub.c

mm/slub.c: add a naive detection of double free or corruption

2017-09-06 17:27:24 -07:00

sparse-vmemmap.c

mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic

2017-07-12 16:26:03 -07:00

sparse.c

mm, memory_hotplug: do not associate hotadded memory to zones until online

2017-07-06 16:24:32 -07:00

swap_cgroup.c

mm, THP, swap: delay splitting THP during swap out

2017-07-06 16:24:31 -07:00

swap_slots.c

mm/swap_slots.c: don't disable preemption while taking the per-CPU cache

2017-07-10 16:32:32 -07:00

swap_state.c

swap: add block io poll in swapin path

2017-07-10 16:32:30 -07:00

swap.c

mm: swap: provide lru_add_drain_all_cpuslocked()

2017-07-10 16:32:33 -07:00

swapfile.c

swap: add block io poll in swapin path

2017-07-10 16:32:30 -07:00

truncate.c

mm/truncate.c: fix THP handling in invalidate_mapping_pages()

2017-07-10 16:32:32 -07:00

usercopy.c

mm/usercopy: Drop extra is_vmalloc_or_module() check

2017-04-05 12:30:18 -07:00

userfaultfd.c

mm: convert generic code to 5-level paging

2017-03-09 11:48:47 -08:00

util.c

mm: fix global NR_SLAB_.*CLAIMABLE counter reads

2017-08-10 15:54:06 -07:00

vmacache.c

sched/headers: Prepare to move 'init_task' and 'init_thread_union' from <linux/sched.h> to <linux/sched/task.h>

2017-03-02 08:42:38 +01:00

vmalloc.c

mm/vmalloc.c: don't unconditonally use __GFP_HIGHMEM

2017-08-18 15:32:02 -07:00

vmpressure.c

mm, vmpressure: pass-through notification support

2017-07-10 16:32:31 -07:00

vmscan.c

locking/lockdep: Rework FS_RECLAIM annotation

2017-08-10 12:29:03 +02:00

vmstat.c

mm: avoid taking zone lock in pagetypeinfo_showmixed()

2017-07-10 16:32:32 -07:00

workingset.c

mm: memcontrol: per-lruvec stats infrastructure

2017-07-06 16:24:35 -07:00

z3fold.c

z3fold: fix page locking in z3fold_alloc()

2017-04-13 18:24:20 -07:00

zbud.c

mm/zbud.c: use list_last_entry() instead of list_tail_entry()

2016-01-15 11:40:52 -08:00

zpool.c

mm: zsmalloc: constify struct zs_pool name

2015-11-06 17:50:42 -08:00

zsmalloc.c

zram: do not free pool->size_class

2017-08-02 16:34:47 -07:00

zswap.c

mm/zswap.c: delete an error message for a failed memory allocation in zswap_dstmem_prepare()

2017-07-06 16:24:35 -07:00