On Fri, 03 Apr 2015 17:47:47 +0300 Andrey Ryabinin <a.ryabinin@xxxxxxxxxxx> wrote:
> Mempools keep allocated objects in reserved for situations
> when ordinary allocation may not be possible to satisfy.
> These objects shouldn't be accessed before they leave
> the pool.
> This patch poison elements when get into the pool
> and unpoison when they leave it. This will let KASan
> to detect use-after-free of mempool's elements.
>
> ...
>
> +static void kasan_poison_element(mempool_t *pool, void *element)
> +{
> + if (pool->alloc == mempool_alloc_slab)
> + kasan_slab_free(pool->pool_data, element);
> + if (pool->alloc == mempool_kmalloc)
> + kasan_kfree(element);
> + if (pool->alloc == mempool_alloc_pages)
> + kasan_free_pages(element, (unsigned long)pool->pool_data);
> +}
We recently discovered that mempool pages (from alloc_pages, not slab)
can be in highmem. But kasan apepars to handle highmem pages (by
baling out) so we should be OK with that.
Can kasan be taught to use kmap_atomic() or is it more complicated than
that? It probably isn't worthwhile - highmem pages don'[t get used by the
kernel much and most bugs will be found using 64-bit testing anyway.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>