The quilt patch titled
Subject: kasan: Improve free meta storage in Generic KASAN
has been removed from the -mm tree. Its filename was
kasan-improve-free-meta-storage-in-generic-kasan-v3.patch
This patch was dropped because it was folded into kasan-improve-free-meta-storage-in-generic-kasan.patch
------------------------------------------------------
From: Juntong Deng <juntong.deng@xxxxxxxxxxx>
Subject: kasan: Improve free meta storage in Generic KASAN
Date: Wed, 22 Nov 2023 18:46:31 +0000
When SLUB DEBUG is enabled, the previous free meta storage method
continues to be used. Cancel the change to kasan_metadata_size().
Make kasan_metadata_size() adapt to the improved free meta storage
Link: https://lkml.kernel.org/r/VI1P193MB0752675D6E0A2D16CE656F8299BAA@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Suggested-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Signed-off-by: Juntong Deng <juntong.deng@xxxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Andrey Konovalov <andreyknvl@xxxxxxxxx>
Cc: Andrey Ryabinin <ryabinin.a.a@xxxxxxxxx>
Cc: Vincenzo Frascino <vincenzo.frascino@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/kasan/generic.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
--- a/mm/kasan/generic.c~kasan-improve-free-meta-storage-in-generic-kasan-v3
+++ a/mm/kasan/generic.c
@@ -407,19 +407,28 @@ void kasan_cache_create(struct kmem_cach
* be touched after it was freed, or
* 2. Object has a constructor, which means it's expected to
* retain its content until the next allocation, or
+ * 3. Object is too small and SLUB DEBUG is enabled. Avoid
+ * free meta that exceeds the object size corrupts the
+ * SLUB DEBUG metadata.
* Otherwise cache->kasan_info.free_meta_offset = 0 is implied.
- * Even if the object is smaller than free meta, it is still
- * possible to store part of the free meta in the object.
+ * If the object is smaller than the free meta and SLUB DEBUG
+ * is not enabled, it is still possible to store part of the
+ * free meta in the object.
*/
if ((cache->flags & SLAB_TYPESAFE_BY_RCU) || cache->ctor) {
cache->kasan_info.free_meta_offset = *size;
*size += sizeof(struct kasan_free_meta);
} else if (cache->object_size < sizeof(struct kasan_free_meta)) {
- rem_free_meta_size = sizeof(struct kasan_free_meta) -
- cache->object_size;
- *size += rem_free_meta_size;
- if (cache->kasan_info.alloc_meta_offset != 0)
- cache->kasan_info.alloc_meta_offset += rem_free_meta_size;
+ if (__slub_debug_enabled()) {
+ cache->kasan_info.free_meta_offset = *size;
+ *size += sizeof(struct kasan_free_meta);
+ } else {
+ rem_free_meta_size = sizeof(struct kasan_free_meta) -
+ cache->object_size;
+ *size += rem_free_meta_size;
+ if (cache->kasan_info.alloc_meta_offset != 0)
+ cache->kasan_info.alloc_meta_offset += rem_free_meta_size;
+ }
}
/* If free meta doesn't fit, don't add it. */
_
Patches currently in -mm which might be from juntong.deng@xxxxxxxxxxx are
kasan-improve-free-meta-storage-in-generic-kasan.patch
kasan-record-and-report-more-information.patch
