From: swkhack <[email protected]> The function lkdtm_WRITE_AFTER_FREE calls kfree(base) to free the memory of base. However, following kfree(base), it write the memory which base point to via base[offset] = 0x0abcdef0. This may result in a use-after-free bug. This patch moves kfree(base) after the write.
Signed-off-by: swkhack <[email protected]> --- drivers/misc/lkdtm/heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c index 65026d7de..0b9141525 100644 --- a/drivers/misc/lkdtm/heap.c +++ b/drivers/misc/lkdtm/heap.c @@ -40,8 +40,8 @@ void lkdtm_WRITE_AFTER_FREE(void) pr_info("Allocated memory %p-%p\n", base, &base[offset * 2]); pr_info("Attempting bad write to freed memory at %p\n", &base[offset]); - kfree(base); base[offset] = 0x0abcdef0; + kfree(base); /* Attempt to notice the overwrite. */ again = kmalloc(len, GFP_KERNEL); kfree(again); -- 2.17.1
