forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

UPSTREAM: kasan: slab: always reset the tag in get_freepointer_safe()

Browse source 
With CONFIG_DEBUG_PAGEALLOC enabled, the kernel should also untag the
object pointer, as done in get_freepointer().

Failing to do so reportedly leads to SLUB freelist corruptions that
manifest as boot-time crashes.

Link: https://lkml.kernel.org/r/20210514072228.534418-1-glider@google.com
Signed-off-by: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Elliot Berman <eberman@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Bug: 181230759
Test: run on QEMU with CONFIG_DEBUG_PAGEALLOC
(cherry picked from commit f70b00496f)
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Ifb512c0241465d8035d55a161bcc304d5b2287d5
This commit is contained in:
Alexander Potapenko 2021-05-22 17:41:56 -07:00
commit 5a18a6da18
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
mm/slub.c
View file

@ -278,6 +278,7 @@ static inline void *get_freepointer_safe(struct kmem_cache *s, void *object)
if (!debug_pagealloc_enabled_static())
return get_freepointer(s, object);
object = kasan_reset_tag(object);
freepointer_addr = (unsigned long)object + s->offset;
copy_from_kernel_nofault(&p, (void **)freepointer_addr, sizeof(p));
return freelist_ptr(s, p, freepointer_addr);