Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1df46a0 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "kasan: detect invalid frees for large mempool objects"

parents 7c12a35a fb52b652

include/linux/kasan.h

+2 −2
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ void kasan_init_slab_obj(struct kmem_cache *cache, const void *object); 


void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags);

void kasan_kfree_large(void *ptr, unsigned long ip);

void kasan_poison_kfree(void *ptr);

void kasan_poison_kfree(void *ptr, unsigned long ip);

void kasan_kmalloc(struct kmem_cache *s, const void *object, size_t size,

		  gfp_t flags);

void kasan_krealloc(const void *object, size_t new_size, gfp_t flags);
@@ -109,7 +109,7 @@ static inline void kasan_init_slab_obj(struct kmem_cache *cache, 


static inline void kasan_kmalloc_large(void *ptr, size_t size, gfp_t flags) {}

static inline void kasan_kfree_large(void *ptr, unsigned long ip) {}

static inline void kasan_poison_kfree(void *ptr) {}

static inline void kasan_poison_kfree(void *ptr, unsigned long ip) {}

static inline void kasan_kmalloc(struct kmem_cache *s, const void *object,

				size_t size, gfp_t flags) {}

static inline void kasan_krealloc(const void *object, size_t new_size,

mm/kasan/kasan.c

+8 −3
Original line number Diff line number Diff line
@@ -588,18 +588,23 @@ void kasan_krealloc(const void *object, size_t size, gfp_t flags) 
		kasan_kmalloc(page->slab_cache, object, size, flags);

}



void kasan_poison_kfree(void *ptr)

void kasan_poison_kfree(void *ptr, unsigned long ip)

{

	struct page *page;



	page = virt_to_head_page(ptr);



	if (unlikely(!PageSlab(page)))

	if (unlikely(!PageSlab(page))) {

		if (ptr != page_address(page)) {

			kasan_report_invalid_free(ptr, ip);

			return;

		}

		kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),

				KASAN_FREE_PAGE);

	else

	} else {

		kasan_poison_slab_free(page->slab_cache, ptr);

	}

}



void kasan_kfree_large(void *ptr, unsigned long ip)

{

mm/mempool.c

+3 −3
Original line number Diff line number Diff line
@@ -103,10 +103,10 @@ static inline void poison_element(mempool_t *pool, void *element) 
}

#endif /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */



static void kasan_poison_element(mempool_t *pool, void *element)

static __always_inline void kasan_poison_element(mempool_t *pool, void *element)

{

	if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)

		kasan_poison_kfree(element);

		kasan_poison_kfree(element, _RET_IP_);

	if (pool->alloc == mempool_alloc_pages)

		kasan_free_pages(element, (unsigned long)pool->pool_data);

}
@@ -119,7 +119,7 @@ static void kasan_unpoison_element(mempool_t *pool, void *element, gfp_t flags) 
		kasan_alloc_pages(element, (unsigned long)pool->pool_data);

}



static void add_element(mempool_t *pool, void *element)

static __always_inline void add_element(mempool_t *pool, void *element)

{

	BUG_ON(pool->curr_nr >= pool->min_nr);

	poison_element(pool, element);