Hello Christopher and Kees, On 26.07.2017 19:55, Christopher Lameter wrote: > On Wed, 26 Jul 2017, Kees Cook wrote: > >>>> What happens if, instead of BUG_ON, we do: >>>> >>>> if (unlikely(WARN_RATELIMIT(object == fp, "double-free detected")) >>>> return; >>> >>> This may work for the free fastpath but the set_freepointer function is >>> use in multiple other locations. Maybe just add this to the fastpath >>> instead of to this fucnction? >> >> Do you mean do_slab_free()? > > Yes inserting these lines into do_slab_free() would simple ignore the > double free operation in the fast path and that would be safe.
I don't really like ignoring double-free. I think, that: - it will hide dangerous bugs in the kernel, - it can make some kernel exploits more stable. I would rather add BUG_ON to set_freepointer() behind SLAB_FREELIST_HARDENED. Is it fine? At the same time avoiding the consequences of some double-free errors is better than not doing that. It may be considered as kernel "self-healing", I don't know. I can prepare a second patch for do_slab_free(), as you described. Would you like it? Best regards, Alexander
