Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0cd340dc authored by Kees Cook's avatar Kees Cook Committed by Paul E. McKenney
Browse files

list: Split list_del() debug checking into separate function 



Similar to the list_add() debug consolidation, this commit consolidates
the debug checking performed during CONFIG_DEBUG_LIST into a new
__list_del_entry_valid() function, and stops list updates when corruption
is found.

Refactored from same hardening in PaX and Grsecurity.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
Acked-by: default avatarRik van Riel <riel@redhat.com>
parent 54acd439

include/linux/list.h

+9 −6
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ static inline void INIT_LIST_HEAD(struct list_head *list) 
extern bool __list_add_valid(struct list_head *new,

			      struct list_head *prev,

			      struct list_head *next);

extern bool __list_del_entry_valid(struct list_head *entry);

#else

static inline bool __list_add_valid(struct list_head *new,

				struct list_head *prev,
@@ -39,6 +40,10 @@ static inline bool __list_add_valid(struct list_head *new, 
{

	return true;

}

static inline bool __list_del_entry_valid(struct list_head *entry)

{

	return true;

}

#endif



/*
@@ -106,22 +111,20 @@ static inline void __list_del(struct list_head * prev, struct list_head * next) 
 * Note: list_empty() on entry does not return true after this, the entry is

 * in an undefined state.

 */

#ifndef CONFIG_DEBUG_LIST

static inline void __list_del_entry(struct list_head *entry)

{

	if (!__list_del_entry_valid(entry))

		return;



	__list_del(entry->prev, entry->next);

}



static inline void list_del(struct list_head *entry)

{

	__list_del(entry->prev, entry->next);

	__list_del_entry(entry);

	entry->next = LIST_POISON1;

	entry->prev = LIST_POISON2;

}

#else

extern void __list_del_entry(struct list_head *entry);

extern void list_del(struct list_head *entry);

#endif



/**

 * list_replace - replace old entry by new one

lib/list_debug.c

+23 −30
Original line number Diff line number Diff line
@@ -39,41 +39,34 @@ bool __list_add_valid(struct list_head *new, struct list_head *prev, 
}

EXPORT_SYMBOL(__list_add_valid);



void __list_del_entry(struct list_head *entry)

bool __list_del_entry_valid(struct list_head *entry)

{

	struct list_head *prev, *next;



	prev = entry->prev;

	next = entry->next;



	if (WARN(next == LIST_POISON1,

		"list_del corruption, %p->next is LIST_POISON1 (%p)\n",

		entry, LIST_POISON1) ||

	    WARN(prev == LIST_POISON2,

		"list_del corruption, %p->prev is LIST_POISON2 (%p)\n",

		entry, LIST_POISON2) ||

	    WARN(prev->next != entry,

		"list_del corruption. prev->next should be %p, "

		"but was %p\n", entry, prev->next) ||

	    WARN(next->prev != entry,

		"list_del corruption. next->prev should be %p, "

		"but was %p\n", entry, next->prev))

		return;



	__list_del(prev, next);

	if (unlikely(next == LIST_POISON1)) {

		WARN(1, "list_del corruption, %p->next is LIST_POISON1 (%p)\n",

			entry, LIST_POISON1);

		return false;

	}

	if (unlikely(prev == LIST_POISON2)) {

		WARN(1, "list_del corruption, %p->prev is LIST_POISON2 (%p)\n",

			entry, LIST_POISON2);

		return false;

	}

	if (unlikely(prev->next != entry)) {

		WARN(1, "list_del corruption. prev->next should be %p, but was %p\n",

			entry, prev->next);

		return false;

	}

EXPORT_SYMBOL(__list_del_entry);

	if (unlikely(next->prev != entry)) {

		WARN(1, "list_del corruption. next->prev should be %p, but was %p\n",

			entry, next->prev);

		return false;

	}

	return true;



/**

 * list_del - deletes entry from list.

 * @entry: the element to delete from the list.

 * Note: list_empty on entry does not return true after this, the entry is

 * in an undefined state.

 */

void list_del(struct list_head *entry)

{

	__list_del_entry(entry);

	entry->next = LIST_POISON1;

	entry->prev = LIST_POISON2;

}

EXPORT_SYMBOL(list_del);
 
EXPORT_SYMBOL(__list_del_entry_valid);