Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fc1c1833 authored by Pekka Enberg's avatar Pekka Enberg Committed by Linus Torvalds
Browse files

slab: Generify kernel pointer validation 



As suggested by Linus, introduce a kern_ptr_validate() helper that does some
sanity checks to make sure a pointer is a valid kernel pointer.  This is a
preparational step for fixing SLUB kmem_ptr_validate().

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Matt Mackall <mpm@selenic.com>
Cc: Nick Piggin <npiggin@suse.de>
Signed-off-by: default avatarPekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 4dc86ae1

include/linux/slab.h

+1 −0
Original line number Diff line number Diff line
@@ -106,6 +106,7 @@ int kmem_cache_shrink(struct kmem_cache *); 
void kmem_cache_free(struct kmem_cache *, void *);

unsigned int kmem_cache_size(struct kmem_cache *);

const char *kmem_cache_name(struct kmem_cache *);

int kern_ptr_validate(const void *ptr, unsigned long size);

int kmem_ptr_validate(struct kmem_cache *cachep, const void *ptr);



/*

mm/slab.c

+1 −12
Original line number Diff line number Diff line
@@ -3602,21 +3602,10 @@ EXPORT_SYMBOL(kmem_cache_alloc_notrace); 
 */

int kmem_ptr_validate(struct kmem_cache *cachep, const void *ptr)

{

	unsigned long addr = (unsigned long)ptr;

	unsigned long min_addr = PAGE_OFFSET;

	unsigned long align_mask = BYTES_PER_WORD - 1;

	unsigned long size = cachep->buffer_size;

	struct page *page;



	if (unlikely(addr < min_addr))

		goto out;

	if (unlikely(addr > (unsigned long)high_memory - size))

		goto out;

	if (unlikely(addr & align_mask))

		goto out;

	if (unlikely(!kern_addr_valid(addr)))

		goto out;

	if (unlikely(!kern_addr_valid(addr + size - 1)))

	if (unlikely(!kern_ptr_validate(ptr, size)))

		goto out;

	page = virt_to_page(ptr);

	if (unlikely(!PageSlab(page)))

mm/util.c

+21 −0
Original line number Diff line number Diff line
@@ -186,6 +186,27 @@ void kzfree(const void *p) 
}

EXPORT_SYMBOL(kzfree);



int kern_ptr_validate(const void *ptr, unsigned long size)

{

	unsigned long addr = (unsigned long)ptr;

	unsigned long min_addr = PAGE_OFFSET;

	unsigned long align_mask = sizeof(void *) - 1;



	if (unlikely(addr < min_addr))

		goto out;

	if (unlikely(addr > (unsigned long)high_memory - size))

		goto out;

	if (unlikely(addr & align_mask))

		goto out;

	if (unlikely(!kern_addr_valid(addr)))

		goto out;

	if (unlikely(!kern_addr_valid(addr + size - 1)))

		goto out;

	return 1;

out:

	return 0;

}



/*

 * strndup_user - duplicate an existing string from user space

 * @s: The string to duplicate