Merge "kasan: detect invalid frees" (796585c3) · Commits · e / devices / android_kernel_xiaomi_nabu

lib/test_kasan.c

+50 −0

Original line number	Diff line number	Diff line
		@@ -504,6 +504,54 @@ static noinline void __init use_after_scope_test(void)
		p[1023] = 1;
		}

		static noinline void __init kmem_cache_double_free(void)
		{
		char *p;
		size_t size = 200;
		struct kmem_cache *cache;

		cache = kmem_cache_create("test_cache", size, 0, 0, NULL);
		if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
		}
		pr_info("double-free on heap object\n");
		p = kmem_cache_alloc(cache, GFP_KERNEL);
		if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
		}

		kmem_cache_free(cache, p);
		kmem_cache_free(cache, p);
		kmem_cache_destroy(cache);
		}

		static noinline void __init kmem_cache_invalid_free(void)
		{
		char *p;
		size_t size = 200;
		struct kmem_cache *cache;

		cache = kmem_cache_create("test_cache", size, 0, SLAB_TYPESAFE_BY_RCU,
		NULL);
		if (!cache) {
		pr_err("Cache allocation failed\n");
		return;
		}
		pr_info("invalid-free of heap object\n");
		p = kmem_cache_alloc(cache, GFP_KERNEL);
		if (!p) {
		pr_err("Allocation failed\n");
		kmem_cache_destroy(cache);
		return;
		}

		kmem_cache_free(cache, p + 1);
		kmem_cache_destroy(cache);
		}

		static int __init kmalloc_tests_init(void)
		{
		/*
		@@ -539,6 +587,8 @@ static int __init kmalloc_tests_init(void)
		ksize_unpoisons_memory();
		copy_user_test();
		use_after_scope_test();
		kmem_cache_double_free();
		kmem_cache_invalid_free();

		kasan_restore_multi_shot(multishot);

+6 −0

Original line number	Diff line number	Diff line
		@@ -495,6 +495,12 @@ static bool __kasan_slab_free(struct kmem_cache cache, void object,
		s8 shadow_byte;
		unsigned long rounded_up_size;

		if (unlikely(nearest_obj(cache, virt_to_head_page(object), object) !=
		object)) {
		kasan_report_invalid_free(object, ip);
		return true;
		}

		/* RCU slabs could be legally used after free within the RCU period */
		if (unlikely(cache->flags & SLAB_TYPESAFE_BY_RCU))
		return false;