archive mirror
 help / color / mirror / Atom feed
From: Vlastimil Babka <>
To: Jann Horn <>, Christoph Lameter <>,
	Pekka Enberg <>,
	David Rientjes <>,
	Joonsoo Kim <>,
	Andrew Morton <>
Cc: Linux-MM <>,
	kernel list <>,
	Kees Cook <>,
	Matthew Garrett <>
Subject: Re: SLUB: sysfs lets root force slab order below required minimum, causing memory corruption
Date: Wed, 4 Mar 2020 14:17:04 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On 3/4/20 1:23 AM, Jann Horn wrote:
> Hi!
> FYI, I noticed that if you do something like the following as root,
> the system blows up pretty quickly with error messages about stuff
> like corrupt freelist pointers because SLUB actually allows root to
> force a page order that is smaller than what is required to store a
> single object:
>     echo 0 > /sys/kernel/slab/task_struct/order
> The other SLUB debugging options, like red_zone, also look kind of
> suspicious with regards to races (either racing with other writes to
> the SLUB debugging options, or with object allocations).

Yeah I also wondered last week that there seems to be no sychronization with
alloc/free activity. Increasing order is AFAICS also dangerous with freelist

      parent reply	other threads:[~2020-03-04 13:17 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-04  0:23 SLUB: sysfs lets root force slab order below required minimum, causing memory corruption Jann Horn
2020-03-04  1:26 ` David Rientjes
2020-03-04  2:22   ` Kees Cook
2020-03-04 17:26     ` Vlastimil Babka
2020-03-04 20:39       ` David Rientjes
2020-03-08 19:34         ` Christopher Lameter
2020-03-04 14:57   ` Pekka Enberg
2020-03-04 13:17 ` Vlastimil Babka [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).