Petr Pavlu f91f7ac900 refcount: Report UAF for refcount_sub_and_test(0) when counter==0 ... When a reference counter is at zero and refcount_sub_and_test() is invoked to subtract zero, the function accepts this request without any warning and returns true. This behavior does not seem ideal because the counter being already at zero indicates a use-after-free. Furthermore, returning true by refcount_sub_and_test() in this case potentially results in a double-free done by its caller. Modify the underlying function __refcount_sub_and_test() to warn about this case as a use-after-free and have it return false to avoid the potential double-free. Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lore.kernel.org/r/20240717130023.5675-1-petr.pavlu@suse.com Signed-off-by: Kees Cook <kees@kernel.org>		2024-08-05 14:34:23 -07:00
..
bugs.c	lkdtm/bugs: add test for hung smp_call_function_single()	2024-06-17 11:17:31 -07:00
cfi.c
core.c	lkdtm: Make lkdtm_do_action() return to avoid tail call optimization	2024-02-01 09:44:07 -08:00
fortify.c
heap.c	mm/slub: unify all sl[au]b parameters with "slab_$param"	2024-01-22 10:31:08 +01:00
lkdtm.h
Makefile	Kbuild updates for v6.10	2024-05-18 12:39:20 -07:00
perms.c	lkdtm: Disable CFI checking for perms functions	2024-05-01 12:37:42 -07:00
powerpc.c
refcount.c	refcount: Report UAF for refcount_sub_and_test(0) when counter==0	2024-08-05 14:34:23 -07:00
rodata.c
stackleak.c
usercopy.c