Re: [PATCH v2 3/3] mm/slub: Actually fix freelist pointer vs redzoning

On 10/9/20 9:54 PM, Kees Cook wrote: It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer), so a cache created with an object size less than 24 would have their freelist pointer

[PATCH v2 3/3] mm/slub: Actually fix freelist pointer vs redzoning

It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make room for the freelist pointer), so a cache created with an object size less than 24 would have their freelist pointer written beyond s->object_size, causing the