From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Andrey Konovalov <andreyknvl@google.com>,
Alexander Potapenko <glider@google.com>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Dmitry Vyukov <dvyukov@google.com>,
Evgeniy Stepanov <eugenis@google.com>,
Kostya Serebryany <kcc@google.com>,
Vincenzo Frascino <vincenzo.frascino@arm.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Sasha Levin <sashal@kernel.org>,
linux-mm@kvack.org
Subject: [PATCH AUTOSEL 4.19 31/48] kasan, slab: make freelist stored without tags
Date: Wed, 13 Mar 2019 15:12:33 -0400 [thread overview]
Message-ID: <20190313191250.158955-31-sashal@kernel.org> (raw)
In-Reply-To: <20190313191250.158955-1-sashal@kernel.org>
From: Andrey Konovalov <andreyknvl@google.com>
[ Upstream commit 51dedad06b5f6c3eea7ec1069631b1ef7796912a ]
Similarly to "kasan, slub: move kasan_poison_slab hook before
page_address", move kasan_poison_slab() before alloc_slabmgmt(), which
calls page_address(), to make page_address() return value to be
non-tagged. This, combined with calling kasan_reset_tag() for off-slab
slab management object, leads to freelist being stored non-tagged.
Link: http://lkml.kernel.org/r/dfb53b44a4d00de3879a05a9f04c1f55e584f7a1.1550602886.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Qian Cai <cai@lca.pw>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgeniy Stepanov <eugenis@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/slab.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/mm/slab.c b/mm/slab.c
index 813bd89c263b..52c0420e4f93 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2381,6 +2381,7 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
/* Slab management obj is off-slab. */
freelist = kmem_cache_alloc_node(cachep->freelist_cache,
local_flags, nodeid);
+ freelist = kasan_reset_tag(freelist);
if (!freelist)
return NULL;
} else {
@@ -2694,6 +2695,13 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
offset *= cachep->colour_off;
+ /*
+ * Call kasan_poison_slab() before calling alloc_slabmgmt(), so
+ * page_address() in the latter returns a non-tagged pointer,
+ * as it should be for slab pages.
+ */
+ kasan_poison_slab(page);
+
/* Get slab management. */
freelist = alloc_slabmgmt(cachep, page, offset,
local_flags & ~GFP_CONSTRAINT_MASK, page_node);
@@ -2702,7 +2710,6 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
slab_map_pages(cachep, page, freelist);
- kasan_poison_slab(page);
cache_init_objs(cachep, page);
if (gfpflags_allow_blocking(local_flags))
--
2.19.1
next prev parent reply other threads:[~2019-03-13 19:27 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-13 19:12 [PATCH AUTOSEL 4.19 01/48] clk: sunxi-ng: v3s: Fix TCON reset de-assert bit Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 02/48] kallsyms: Handle too long symbols in kallsyms.c Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 03/48] clk: sunxi: A31: Fix wrong AHB gate number Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 04/48] esp: Skip TX bytes accounting when sending from a request socket Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 05/48] ARM: 8824/1: fix a migrating irq bug when hotplug cpu Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 06/48] bpf: only adjust gso_size on bytestream protocols Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 07/48] bpf: fix lockdep false positive in stackmap Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 08/48] af_key: unconditionally clone on broadcast Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 09/48] ARM: 8835/1: dma-mapping: Clear DMA ops on teardown Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 10/48] assoc_array: Fix shortcut creation Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 11/48] keys: Fix dependency loop between construction record and auth key Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 12/48] scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 13/48] net: systemport: Fix reception of BPDUs Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 14/48] net: dsa: bcm_sf2: Do not assume DSA master supports WoL Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 15/48] pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 16/48] qmi_wwan: apply SET_DTR quirk to Sierra WP7607 Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 17/48] net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 18/48] xfrm: Fix inbound traffic via XFRM interfaces across network namespaces Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 19/48] mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 20/48] ASoC: topology: free created components in tplg load error Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 21/48] qed: Fix iWARP buffer size provided for syn packet processing Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 22/48] qed: Fix iWARP syn packet mac address validation Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 23/48] ARM: dts: armada-xp: fix Armada XP boards NAND description Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 24/48] arm64: Relax GIC version check during early boot Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 25/48] ARM: tegra: Restore DT ABI on Tegra124 Chromebooks Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 26/48] net: marvell: mvneta: fix DMA debug warning Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 27/48] kasan, slub: move kasan_poison_slab hook before page_address Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 28/48] mm: handle lru_add_drain_all for UP properly Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 29/48] tmpfs: fix link accounting when a tmpfile is linked in Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 30/48] kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY Sasha Levin
2019-03-13 19:12 ` Sasha Levin [this message]
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 32/48] ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 33/48] ARCv2: lib: memcpy: fix doing prefetchw outside of buffer Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 34/48] ARC: uacces: remove lp_start, lp_end from clobber list Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 35/48] ARCv2: support manual regfile save on interrupts Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 36/48] ARCv2: don't assume core 0x54 has dual issue Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 37/48] phonet: fix building with clang Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 38/48] mac80211_hwsim: propagate genlmsg_reply return code Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 39/48] bpf, lpm: fix lookup bug in map_delete_elem Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 40/48] net: thunderx: make CFG_DONE message to run through generic send-ack sequence Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 41/48] net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 42/48] nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 43/48] nfp: bpf: fix ALU32 high bits clearance bug Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 44/48] bnxt_en: Fix typo in firmware message timeout logic Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 45/48] bnxt_en: Wait longer for the firmware message response to complete Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 46/48] mdio_bus: Fix use-after-free on device_register fails Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 47/48] net: set static variable an initial value in atl2_probe() Sasha Levin
2019-03-13 19:12 ` [PATCH AUTOSEL 4.19 48/48] selftests: fib_tests: sleep after changing carrier. again Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190313191250.158955-31-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=aryabinin@virtuozzo.com \
--cc=catalin.marinas@arm.com \
--cc=dvyukov@google.com \
--cc=eugenis@google.com \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=vincenzo.frascino@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).