mm/slub.c: add a naive detection of double free or corruption

Add an assertion similar to "fasttop" check in GNU C Library allocator
as a part of SLAB_FREELIST_HARDENED feature.  An object added to a
singly linked freelist should not point to itself.  That helps to detect
some double free errors (e.g. CVE-2017-2636) without slub_debug and
KASAN.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Alexander Popov <[email protected]>
Acked-by: Christoph Lameter <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Pekka Enberg <[email protected]>
Cc: David Rientjes <[email protected]>
Cc: Joonsoo Kim <[email protected]>
Cc: Paul E McKenney <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Tejun Heo <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Nicolas Pitre <[email protected]>
Cc: Rik van Riel <[email protected]>
Cc: Tycho Andersen <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/mm/slub.c b/mm/slub.c
index 6c87c2c6af24e8fe78bb449c8bc3962a7909b03a..16a60f871f395fb190115fa4704c4d70a8c0af29 100644 (file)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -290,6 +290,10 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
 {
        unsigned long freeptr_addr = (unsigned long)object + s->offset;
 
+#ifdef CONFIG_SLAB_FREELIST_HARDENED
+       BUG_ON(object == fp); /* naive detection of double free or corruption */
+#endif
+
        *(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr);
 }