The patch titled
Subject: kasan, slub: fix conflicts with CONFIG_SLAB_FREELIST_HARDENED
has been added to the -mm tree. Its filename is
kasan-slub-fix-conflicts-with-config_slab_freelist_hardened.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/kasan-slub-fix-conflicts-with-config_slab_freelist_hardened.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/kasan-slub-fix-conflicts-with-config_slab_freelist_hardened.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Subject: kasan, slub: fix conflicts with CONFIG_SLAB_FREELIST_HARDENED
CONFIG_SLAB_FREELIST_HARDENED hashes freelist pointer with the address of
the object where the pointer gets stored. With tag based KASAN we don't
account for that when building freelist, as we call set_freepointer() with
the first argument untagged. This patch changes the code to properly
propagate tags throughout the loop.
Link: http://lkml.kernel.org/r/3df171559c52201376f246bf7ce3184fe21c1dc7.1549921721.git.andreyknvl@xxxxxxxxxx
Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Reported-by: Qian Cai <cai@xxxxxx>
Cc: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
Cc: Christoph Lameter <cl@xxxxxxxxx>
Cc: Pekka Enberg <penberg@xxxxxxxxxx>
Cc: David Rientjes <rientjes@xxxxxxxxxx>
Cc: Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>
Cc: Vincenzo Frascino <vincenzo.frascino@xxxxxxx>
Cc: Kostya Serebryany <kcc@xxxxxxxxxx>
Cc: Evgeniy Stepanov <eugenis@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
--- a/mm/slub.c~kasan-slub-fix-conflicts-with-config_slab_freelist_hardened
+++ a/mm/slub.c
@@ -303,11 +303,6 @@ static inline void set_freepointer(struc
__p < (__addr) + (__objects) * (__s)->size; \
__p += (__s)->size)
-#define for_each_object_idx(__p, __idx, __s, __addr, __objects) \
- for (__p = fixup_red_left(__s, __addr), __idx = 1; \
- __idx <= __objects; \
- __p += (__s)->size, __idx++)
-
/* Determine object index from a given position */
static inline unsigned int slab_index(void *p, struct kmem_cache *s, void *addr)
{
@@ -1655,17 +1650,16 @@ static struct page *allocate_slab(struct
shuffle = shuffle_freelist(s, page);
if (!shuffle) {
- for_each_object_idx(p, idx, s, start, page->objects) {
- if (likely(idx < page->objects)) {
- next = p + s->size;
- next = setup_object(s, page, next);
- set_freepointer(s, p, next);
- } else
- set_freepointer(s, p, NULL);
- }
start = fixup_red_left(s, start);
start = setup_object(s, page, start);
page->freelist = start;
+ for (idx = 0, p = start; idx < page->objects - 1; idx++) {
+ next = p + s->size;
+ next = setup_object(s, page, next);
+ set_freepointer(s, p, next);
+ p = next;
+ }
+ set_freepointer(s, p, NULL);
}
page->inuse = page->objects;
_
Patches currently in -mm which might be from andreyknvl@xxxxxxxxxx are
kasan-fix-assigning-tags-twice.patch
kasan-kmemleak-pass-tagged-pointers-to-kmemleak.patch
kmemleak-account-for-tagged-pointers-when-calculating-pointer-range.patch
kasan-slub-move-kasan_poison_slab-hook-before-page_address.patch
kasan-slub-fix-conflicts-with-config_slab_freelist_hardened.patch
