Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
In the Linux kernel, the following vulnerability has been resolved:mm, slub: avoid zeroing kmalloc redzoneSince commit 946fa0dbf2d8 ( mm/slub: extend redzone check to extraallocated kmalloc space than requested ), setting orig_size treatsthe wasted space (object_size - orig_size) as a redzone. However withinit_on_free=1 we clear the full object->size, including the redzone.Additionally we clear the object metadata, including the stored orig_size,making it zero, which makes check_object() treat the whole object as aredzone.These issues lead to the following BUG report with slub_debug=FUZinit_on_free=1 :[ 0.000000] =============================================================================[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten[ 0.000000] -----------------------------------------------------------------------------[ 0.000000][ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8[ 0.000000][ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)[ 0.000000] Call trace:[ 0.000000] dump_backtrace+0x90/0xe8[ 0.000000] show_stack+0x18/0x24[ 0.000000] dump_stack_lvl+0x74/0x8c[ 0.000000] dump_stack+0x18/0x24[ 0.000000] print_trailer+0x150/0x218[ 0.000000] check_object+0xe4/0x454[ 0.000000] free_to_partial_list+0x2f8/0x5ecTo address the issue, use orig_size to clear the used area. And restorethe value of orig_size after clear the remaining area.When CONFIG_SLUB_DEBUG not defined, (get_orig_size() directly returnss->object_size. So when using memset to init the area, the size can simplybe orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG notenabled. And orig_size can never be bigger than object_size.
