Loading Documentation/kasan.txt +5 −3 Original line number Diff line number Diff line Loading @@ -9,7 +9,9 @@ a fast and comprehensive solution for finding use-after-free and out-of-bounds bugs. KASan uses compile-time instrumentation for checking every memory access, therefore you will need a certain version of GCC > 4.9.2 therefore you will need a gcc version of 4.9.2 or later. KASan could detect out of bounds accesses to stack or global variables, but only if gcc 5.0 or later was used to built the kernel. Currently KASan is supported only for x86_64 architecture and requires that the kernel be built with the SLUB allocator. Loading @@ -23,8 +25,8 @@ To enable KASAN configure kernel with: and choose between CONFIG_KASAN_OUTLINE and CONFIG_KASAN_INLINE. Outline/inline is compiler instrumentation types. The former produces smaller binary the latter is 1.1 - 2 times faster. Inline instrumentation requires GCC 5.0 or latter. latter is 1.1 - 2 times faster. Inline instrumentation requires a gcc version of 5.0 or later. Currently KASAN works only with the SLUB memory allocator. For better bug detection and nicer report, enable CONFIG_STACKTRACE and put Loading drivers/staging/android/binder.c +5 −5 Original line number Diff line number Diff line Loading @@ -548,7 +548,6 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, { void *page_addr; unsigned long user_page_addr; struct vm_struct tmp_area; struct page **page; struct mm_struct *mm; Loading Loading @@ -597,10 +596,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, proc->pid, page_addr); goto err_alloc_page_failed; } tmp_area.addr = page_addr; tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; ret = map_vm_area(&tmp_area, PAGE_KERNEL, page); if (ret) { ret = map_kernel_range_noflush((unsigned long)page_addr, PAGE_SIZE, PAGE_KERNEL, page); flush_cache_vmap((unsigned long)page_addr, (unsigned long)page_addr + PAGE_SIZE); if (ret != 1) { pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", proc->pid, page_addr); goto err_map_kernel_failed; Loading include/linux/kasan.h +3 −6 Original line number Diff line number Diff line Loading @@ -5,6 +5,7 @@ struct kmem_cache; struct page; struct vm_struct; #ifdef CONFIG_KASAN Loading Loading @@ -49,15 +50,11 @@ void kasan_krealloc(const void *object, size_t new_size); void kasan_slab_alloc(struct kmem_cache *s, void *object); void kasan_slab_free(struct kmem_cache *s, void *object); #define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT) int kasan_module_alloc(void *addr, size_t size); void kasan_module_free(void *addr); void kasan_free_shadow(const struct vm_struct *vm); #else /* CONFIG_KASAN */ #define MODULE_ALIGN 1 static inline void kasan_unpoison_shadow(const void *address, size_t size) {} static inline void kasan_enable_current(void) {} Loading @@ -82,7 +79,7 @@ static inline void kasan_slab_alloc(struct kmem_cache *s, void *object) {} static inline void kasan_slab_free(struct kmem_cache *s, void *object) {} static inline int kasan_module_alloc(void *addr, size_t size) { return 0; } static inline void kasan_module_free(void *addr) {} static inline void kasan_free_shadow(const struct vm_struct *vm) {} #endif /* CONFIG_KASAN */ Loading include/linux/moduleloader.h +7 −0 Original line number Diff line number Diff line Loading @@ -82,4 +82,11 @@ int module_finalize(const Elf_Ehdr *hdr, /* Any cleanup needed when module leaves. */ void module_arch_cleanup(struct module *mod); #ifdef CONFIG_KASAN #include <linux/kasan.h> #define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT) #else #define MODULE_ALIGN PAGE_SIZE #endif #endif include/linux/slub_def.h +19 −0 Original line number Diff line number Diff line Loading @@ -110,4 +110,23 @@ static inline void sysfs_slab_remove(struct kmem_cache *s) } #endif /** * virt_to_obj - returns address of the beginning of object. * @s: object's kmem_cache * @slab_page: address of slab page * @x: address within object memory range * * Returns address of the beginning of object */ static inline void *virt_to_obj(struct kmem_cache *s, const void *slab_page, const void *x) { return (void *)x - ((x - slab_page) % s->size); } void object_err(struct kmem_cache *s, struct page *page, u8 *object, char *reason); #endif /* _LINUX_SLUB_DEF_H */ Loading
Documentation/kasan.txt +5 −3 Original line number Diff line number Diff line Loading @@ -9,7 +9,9 @@ a fast and comprehensive solution for finding use-after-free and out-of-bounds bugs. KASan uses compile-time instrumentation for checking every memory access, therefore you will need a certain version of GCC > 4.9.2 therefore you will need a gcc version of 4.9.2 or later. KASan could detect out of bounds accesses to stack or global variables, but only if gcc 5.0 or later was used to built the kernel. Currently KASan is supported only for x86_64 architecture and requires that the kernel be built with the SLUB allocator. Loading @@ -23,8 +25,8 @@ To enable KASAN configure kernel with: and choose between CONFIG_KASAN_OUTLINE and CONFIG_KASAN_INLINE. Outline/inline is compiler instrumentation types. The former produces smaller binary the latter is 1.1 - 2 times faster. Inline instrumentation requires GCC 5.0 or latter. latter is 1.1 - 2 times faster. Inline instrumentation requires a gcc version of 5.0 or later. Currently KASAN works only with the SLUB memory allocator. For better bug detection and nicer report, enable CONFIG_STACKTRACE and put Loading
drivers/staging/android/binder.c +5 −5 Original line number Diff line number Diff line Loading @@ -548,7 +548,6 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, { void *page_addr; unsigned long user_page_addr; struct vm_struct tmp_area; struct page **page; struct mm_struct *mm; Loading Loading @@ -597,10 +596,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, proc->pid, page_addr); goto err_alloc_page_failed; } tmp_area.addr = page_addr; tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; ret = map_vm_area(&tmp_area, PAGE_KERNEL, page); if (ret) { ret = map_kernel_range_noflush((unsigned long)page_addr, PAGE_SIZE, PAGE_KERNEL, page); flush_cache_vmap((unsigned long)page_addr, (unsigned long)page_addr + PAGE_SIZE); if (ret != 1) { pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", proc->pid, page_addr); goto err_map_kernel_failed; Loading
include/linux/kasan.h +3 −6 Original line number Diff line number Diff line Loading @@ -5,6 +5,7 @@ struct kmem_cache; struct page; struct vm_struct; #ifdef CONFIG_KASAN Loading Loading @@ -49,15 +50,11 @@ void kasan_krealloc(const void *object, size_t new_size); void kasan_slab_alloc(struct kmem_cache *s, void *object); void kasan_slab_free(struct kmem_cache *s, void *object); #define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT) int kasan_module_alloc(void *addr, size_t size); void kasan_module_free(void *addr); void kasan_free_shadow(const struct vm_struct *vm); #else /* CONFIG_KASAN */ #define MODULE_ALIGN 1 static inline void kasan_unpoison_shadow(const void *address, size_t size) {} static inline void kasan_enable_current(void) {} Loading @@ -82,7 +79,7 @@ static inline void kasan_slab_alloc(struct kmem_cache *s, void *object) {} static inline void kasan_slab_free(struct kmem_cache *s, void *object) {} static inline int kasan_module_alloc(void *addr, size_t size) { return 0; } static inline void kasan_module_free(void *addr) {} static inline void kasan_free_shadow(const struct vm_struct *vm) {} #endif /* CONFIG_KASAN */ Loading
include/linux/moduleloader.h +7 −0 Original line number Diff line number Diff line Loading @@ -82,4 +82,11 @@ int module_finalize(const Elf_Ehdr *hdr, /* Any cleanup needed when module leaves. */ void module_arch_cleanup(struct module *mod); #ifdef CONFIG_KASAN #include <linux/kasan.h> #define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT) #else #define MODULE_ALIGN PAGE_SIZE #endif #endif
include/linux/slub_def.h +19 −0 Original line number Diff line number Diff line Loading @@ -110,4 +110,23 @@ static inline void sysfs_slab_remove(struct kmem_cache *s) } #endif /** * virt_to_obj - returns address of the beginning of object. * @s: object's kmem_cache * @slab_page: address of slab page * @x: address within object memory range * * Returns address of the beginning of object */ static inline void *virt_to_obj(struct kmem_cache *s, const void *slab_page, const void *x) { return (void *)x - ((x - slab_page) % s->size); } void object_err(struct kmem_cache *s, struct page *page, u8 *object, char *reason); #endif /* _LINUX_SLUB_DEF_H */