diff options
| author | Kees Cook <keescook@chromium.org> | 2022-02-16 23:15:03 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-14 17:53:59 +0300 |
| commit | 9a04367c8fa1b593806096d146ba4cfb4a49a2ba (patch) | |
| tree | ded8085c62e0a886f5dddb638afb962d43668cdb /lib/memory-notifier-error-inject.c | |
| parent | 273428016292967bebb3c3ee45183e26e3a903fc (diff) | |
| download | linux-9a04367c8fa1b593806096d146ba4cfb4a49a2ba.tar.xz | |
lkdtm/usercopy: Expand size of "out of frame" object
[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
To be sufficiently out of range for the usercopy test to see the lifetime
mismatch, expand the size of the "bad" buffer, which will let it be
beyond current_stack_pointer regardless of stack growth direction.
Paired with the recent addition of stack depth checking under
CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'lib/memory-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions