[lkml]   [2020]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] slub: Relocate freelist pointer to middle of object
On Thu, 5 Mar 2020, Kees Cook wrote:

> Instead of having the freelist pointer at the very beginning of an
> allocation (offset 0) or at the very end of an allocation (effectively
> offset -sizeof(void *) from the next allocation), move it away from
> the edges of the allocation and into the middle. This provides some
> protection against small-sized neighboring overflows (or underflows),
> for which the freelist pointer is commonly the target. (Large or well
> controlled overwrites are much more likely to attack live object contents,
> instead of attempting freelist corruption.)

Sounds good. You could even randomize the position to avoid attacks on via
the freelist pointer.

Acked-by: Christoph Lameter <>

 \ /
  Last update: 2020-03-08 20:21    [W:0.058 / U:0.456 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site