Notices by Jann Horn (jann@infosec.exchange)

Embed this notice
Jann Horn (jann@infosec.exchange)'s status on Wednesday, 02-Apr-2025 01:26:50 JST Jann Horn

fun Linux fact: because MAP_SHARED|MAP_ANONYMOUS is actually a file-backed mapping under the hood, unmapping part of such a mapping does not discard the data stored in that part:
$ cat mremap.c
#define _GNU_SOURCE
#include <err.h>
#include <stdio.h>
#include <sys/mman.h>
int main(void) {
char *p = mmap(NULL, 0x2000, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, 0);
if (p == MAP_FAILED) err(1, "mmap");
p[0x1000] = 'X';
if (munmap(p+0x1000, 0x1000)) err(1, "munmap");
// that 'X' we just wrote... is it gone?
// nope, let's bring it back!
p = mremap(p, 0x1000, 0x2000, MREMAP_MAYMOVE);
if (p == MAP_FAILED) err(1, "mremap");
printf("p[0x1000]='%c'\n", p[0x1000]);
}
$ gcc -o mremap mremap.c
$ ./mremap
p[0x1000]='X'
$

In conversation about 18 days ago from infosec.exchange permalink
Embed this notice
Jann Horn (jann@infosec.exchange)'s status on Saturday, 29-Mar-2025 07:18:57 JST Jann Horn

Wow, __builtin_dump_struct is an amazing clang feature, how did I never hear about this before?
$ cat test.c
#include <stdio.h>

struct nested {
int n;
};
struct foo {
int member_a;
unsigned long member_b;
char *str;
void *ptr;
struct nested nested;
};

int main(void) {
struct foo f = {
.member_a = 123,
.member_b = 0x4141414141414141,
.str = "foobar",
.ptr = &f,
.nested = {.n = 42}
};
__builtin_dump_struct(&f, printf);
}
$ clang -o test test.c && ./test
struct foo {
int member_a = 123
unsigned long member_b = 4702111234474983745
char * str = "foobar"
void * ptr = 0x7fff1df41b78
struct nested nested = {
int n = 42
}
}
The original version of this feature was introduced back in 2018 (though it was reimplemented since in 2022).

In conversation about 22 days ago from infosec.exchange permalink
Embed this notice
Jann Horn (jann@infosec.exchange)'s status on Monday, 23-Sep-2024 12:11:22 JST Jann Horn
in reply to
- Alan Coopersmith
@alanc aah, and I guess that also means it's safe if the compiler optimizes malloc(0) into NULL when the libc doesn't do that, only the other direction would break stuff...

In conversation about 7 months ago from infosec.exchange permalink
Embed this notice
Jann Horn (jann@infosec.exchange)'s status on Monday, 23-Sep-2024 12:11:03 JST Jann Horn
in reply to
- Alan Coopersmith
@alanc trying to determine at build time if malloc can return NULL seems kinda unsafe anyway? like, what if the same kind of compiler optimization also applies to the code that uses the macro, or if an update to the libc changes this behavior?

In conversation about 7 months ago from infosec.exchange permalink
Embed this notice
Jann Horn (jann@infosec.exchange)'s status on Saturday, 07-Sep-2024 09:59:12 JST Jann Horn

I added code to Linux to help KASAN detect specific types of UAFs more reliably (https://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab.git/commit/?h=slab/for-6.12/rcu_barriers&id=b8c8ba73c68bb3c3e9dad22f488b86c540c839f9), it's been in the linux-next integration tree for, I don't know, a month or so maybe (though it's not in the mainline tree yet), and still there are zero hits on LKML of bugs caught where the stack trace involves my detection...
It's nice that there apparently aren't a lot of easy-to-find bugs of this type around but it's also a little disappointing to not immediately get some nice results from my work...
In conversation about 7 months ago from infosec.exchange permalink
Attachments
1. Domain not in remote thumbnail source whitelist: git.kernel.org
  
  slub: Introduce CONFIG_SLUB_RCU_DEBUG - kernel/git/vbabka/slab.git - The slab kernel tree
Embed this notice
Jann Horn (jann@infosec.exchange)'s status on Wednesday, 13-Sep-2023 01:43:39 JST Jann Horn
in reply to
- warthog9
@warthog9 what is the issue with gmail? is their SMTP dialog slower than other mail servers' or something like that?

In conversation Wednesday, 13-Sep-2023 01:43:39 JST from infosec.exchange permalink

Public

Notices by Jann Horn (jann@infosec.exchange)

User actions

Following 0

Followers 0

Groups 0

Statistics

Feeds