The patch titled
Subject: kasan: untag addresses for KFENCE
has been removed from the -mm tree. Its filename was
kfence-kasan-make-kfence-compatible-with-kasan-fix-2.patch
This patch was dropped because it was folded into kfence-kasan-make-kfence-compatible-with-kasan.patch
------------------------------------------------------
From: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Subject: kasan: untag addresses for KFENCE
KFENCE annotations operate on untagged addresses.
Untag addresses in KASAN runtime where they might be tagged.
Link: https://lkml.kernel.org/r/9dc196006921b191d25d10f6e611316db7da2efc.1611946152.git.andreyknvl@xxxxxxxxxx
Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
Reviewed-by: Marco Elver <elver@xxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Reviewed-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Reviewed-by: Jann Horn <jannh@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/kasan/common.c | 2 +-
mm/kasan/kasan.h | 12 +++++++++---
2 files changed, 10 insertions(+), 4 deletions(-)
--- a/mm/kasan/common.c~kfence-kasan-make-kfence-compatible-with-kasan-fix-2
+++ a/mm/kasan/common.c
@@ -416,7 +416,7 @@ static void *____kasan_kmalloc(struct km
if (unlikely(object == NULL))
return NULL;
- if (is_kfence_address(object))
+ if (is_kfence_address(kasan_reset_tag(object)))
return (void *)object;
redzone_start = round_up((unsigned long)(object + size),
--- a/mm/kasan/kasan.h~kfence-kasan-make-kfence-compatible-with-kasan-fix-2
+++ a/mm/kasan/kasan.h
@@ -320,22 +320,28 @@ static inline u8 kasan_random_tag(void)
static inline void kasan_poison(const void *address, size_t size, u8 value)
{
+ address = kasan_reset_tag(address);
+
/* Skip KFENCE memory if called explicitly outside of sl*b. */
if (is_kfence_address(address))
return;
- hw_set_mem_tag_range(kasan_reset_tag(address),
+ hw_set_mem_tag_range((void *)address,
round_up(size, KASAN_GRANULE_SIZE), value);
}
static inline void kasan_unpoison(const void *address, size_t size)
{
+ u8 tag = get_tag(address);
+
+ address = kasan_reset_tag(address);
+
/* Skip KFENCE memory if called explicitly outside of sl*b. */
if (is_kfence_address(address))
return;
- hw_set_mem_tag_range(kasan_reset_tag(address),
- round_up(size, KASAN_GRANULE_SIZE), get_tag(address));
+ hw_set_mem_tag_range((void *)address,
+ round_up(size, KASAN_GRANULE_SIZE), tag);
}
static inline bool kasan_byte_accessible(const void *addr)
_
Patches currently in -mm which might be from andreyknvl@xxxxxxxxxx are
kfence-kasan-make-kfence-compatible-with-kasan.patch
kasan-mm-dont-save-alloc-stacks-twice.patch
kasan-mm-optimize-kmalloc-poisoning.patch
kasan-optimize-large-kmalloc-poisoning.patch
kasan-clean-up-setting-free-info-in-kasan_slab_free.patch
kasan-unify-large-kfree-checks.patch
kasan-rework-krealloc-tests.patch
kasan-mm-fail-krealloc-on-freed-objects.patch
kasan-mm-optimize-krealloc-poisoning.patch
kasan-ensure-poisoning-size-alignment.patch
arm64-kasan-simplify-and-inline-mte-functions.patch
kasan-inline-hw_tags-helper-functions.patch
kasan-clarify-that-only-first-bug-is-reported-in-hw_tags.patch
