* [PATCH] mm: kasan: don't touch metadata in kasan_[un]poison_element()
@ 2016-06-01 12:53 Alexander Potapenko
2016-06-01 16:22 ` Andrey Ryabinin
0 siblings, 1 reply; 4+ messages in thread
From: Alexander Potapenko @ 2016-06-01 12:53 UTC (permalink / raw)
To: adech.fo, cl, dvyukov, akpm, rostedt, iamjoonsoo.kim, js1304,
kcc, aryabinin, kuthonuzo.luruo
Cc: kasan-dev, linux-mm, linux-kernel
To avoid draining the mempools, KASAN shouldn't put the mempool elements
into the quarantine upon mempool_free(). It shouldn't store
allocation/deallocation stacks upon mempool_alloc()/mempool_free() either.
Therefore make kasan_[un]poison_element() just change the shadow memory,
not the metadata.
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: Kuthonuzo Luruo <kuthonuzo.luruo@hpe.com>
---
include/linux/kasan.h | 8 ++++++--
mm/kasan/kasan.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
mm/mempool.c | 5 +++--
mm/slab.c | 4 ++--
mm/slab.h | 2 +-
5 files changed, 57 insertions(+), 10 deletions(-)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 611927f..bafc13a 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -63,8 +63,10 @@ void kasan_kfree(void *ptr);
void kasan_kmalloc(struct kmem_cache *s, const void *object, size_t size,
gfp_t flags);
void kasan_krealloc(const void *object, size_t new_size, gfp_t flags);
+void kasan_unpoison_kmalloc(const void *object, size_t size, gfp_t flags);
-void kasan_slab_alloc(struct kmem_cache *s, void *object, gfp_t flags);
+void kasan_slab_alloc(struct kmem_cache *s, void *object, bool just_unpoison,
+ gfp_t flags);
bool kasan_slab_free(struct kmem_cache *s, void *object);
void kasan_poison_slab_free(struct kmem_cache *s, void *object);
@@ -107,9 +109,11 @@ static inline void kasan_kmalloc(struct kmem_cache *s, const void *object,
size_t size, gfp_t flags) {}
static inline void kasan_krealloc(const void *object, size_t new_size,
gfp_t flags) {}
+static inline void kasan_unpoison_kmalloc(const void *object, size_t size,
+ gfp_t flags) {}
static inline void kasan_slab_alloc(struct kmem_cache *s, void *object,
- gfp_t flags) {}
+ bool just_unpoison, gfp_t flags) {}
static inline bool kasan_slab_free(struct kmem_cache *s, void *object)
{
return false;
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 18b6a2b..8820f22 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -503,9 +503,13 @@ struct kasan_free_meta *get_free_info(struct kmem_cache *cache,
}
#endif
-void kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags)
+void kasan_slab_alloc(struct kmem_cache *cache, void *object,
+ bool just_unpoison, gfp_t flags)
{
- kasan_kmalloc(cache, object, cache->object_size, flags);
+ if (just_unpoison)
+ kasan_unpoison_shadow(object, cache->object_size);
+ else
+ kasan_kmalloc(cache, object, cache->object_size, flags);
}
void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
@@ -611,6 +615,31 @@ void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags)
KASAN_PAGE_REDZONE);
}
+void kasan_unpoison_kmalloc(const void *object, size_t size, gfp_t flags)
+{
+ struct page *page;
+ unsigned long redzone_start;
+ unsigned long redzone_end;
+
+ if (unlikely(object == ZERO_SIZE_PTR) || (object == NULL))
+ return;
+
+ page = virt_to_head_page(object);
+ redzone_start = round_up((unsigned long)(object + size),
+ KASAN_SHADOW_SCALE_SIZE);
+
+ if (unlikely(!PageSlab(page)))
+ redzone_end = (unsigned long)object +
+ (PAGE_SIZE << compound_order(page));
+ else
+ redzone_end = round_up(
+ (unsigned long)object + page->slab_cache->object_size,
+ KASAN_SHADOW_SCALE_SIZE);
+ kasan_unpoison_shadow(object, size);
+ kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
+ KASAN_KMALLOC_REDZONE);
+}
+
void kasan_krealloc(const void *object, size_t size, gfp_t flags)
{
struct page *page;
@@ -636,7 +665,20 @@ void kasan_kfree(void *ptr)
kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
KASAN_FREE_PAGE);
else
- kasan_slab_free(page->slab_cache, ptr);
+ kasan_poison_slab_free(page->slab_cache, ptr);
+}
+
+void kasan_poison_kfree(void *ptr)
+{
+ struct page *page;
+
+ page = virt_to_head_page(ptr);
+
+ if (unlikely(!PageSlab(page)))
+ kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
+ KASAN_FREE_PAGE);
+ else
+ kasan_poison_slab_free(page->slab_cache, ptr);
}
void kasan_kfree_large(const void *ptr)
diff --git a/mm/mempool.c b/mm/mempool.c
index 9e075f8..bcd48c6 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -115,9 +115,10 @@ static void kasan_poison_element(mempool_t *pool, void *element)
static void kasan_unpoison_element(mempool_t *pool, void *element, gfp_t flags)
{
if (pool->alloc == mempool_alloc_slab)
- kasan_slab_alloc(pool->pool_data, element, flags);
+ kasan_slab_alloc(pool->pool_data, element,
+ /*just_unpoison*/ false, flags);
if (pool->alloc == mempool_kmalloc)
- kasan_krealloc(element, (size_t)pool->pool_data, flags);
+ kasan_unpoison_kmalloc(element, (size_t)pool->pool_data, flags);
if (pool->alloc == mempool_alloc_pages)
kasan_alloc_pages(element, (unsigned long)pool->pool_data);
}
diff --git a/mm/slab.c b/mm/slab.c
index cc8bbc1..b42ae23 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3606,7 +3606,7 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
{
void *ret = slab_alloc(cachep, flags, _RET_IP_);
- kasan_slab_alloc(cachep, ret, flags);
+ kasan_slab_alloc(cachep, ret, /*just_unpoison*/ false, flags);
trace_kmem_cache_alloc(_RET_IP_, ret,
cachep->object_size, cachep->size, flags);
@@ -3696,7 +3696,7 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid)
{
void *ret = slab_alloc_node(cachep, flags, nodeid, _RET_IP_);
- kasan_slab_alloc(cachep, ret, flags);
+ kasan_slab_alloc(cachep, ret, /*just_unpoison*/ false, flags);
trace_kmem_cache_alloc_node(_RET_IP_, ret,
cachep->object_size, cachep->size,
flags, nodeid);
diff --git a/mm/slab.h b/mm/slab.h
index dedb1a9..d56c042 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -405,7 +405,7 @@ static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
kmemcheck_slab_alloc(s, flags, object, slab_ksize(s));
kmemleak_alloc_recursive(object, s->object_size, 1,
s->flags, flags);
- kasan_slab_alloc(s, object, flags);
+ kasan_slab_alloc(s, object, /*just_unpoison*/false, flags);
}
memcg_kmem_put_cache(s);
}
--
2.8.0.rc3.226.g39d4020
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] mm: kasan: don't touch metadata in kasan_[un]poison_element()
2016-06-01 12:53 [PATCH] mm: kasan: don't touch metadata in kasan_[un]poison_element() Alexander Potapenko
@ 2016-06-01 16:22 ` Andrey Ryabinin
2016-06-09 14:05 ` [PATCH] mm: mempool: kasan: don't poot mempool objects in quarantine Andrey Ryabinin
0 siblings, 1 reply; 4+ messages in thread
From: Andrey Ryabinin @ 2016-06-01 16:22 UTC (permalink / raw)
To: Alexander Potapenko, adech.fo, cl, dvyukov, akpm, rostedt,
iamjoonsoo.kim, js1304, kcc, kuthonuzo.luruo
Cc: kasan-dev, linux-mm, linux-kernel
On 06/01/2016 03:53 PM, Alexander Potapenko wrote:
> To avoid draining the mempools, KASAN shouldn't put the mempool elements
> into the quarantine upon mempool_free().
Correct, but unfortunately this patch doesn't fix that.
> It shouldn't store
> allocation/deallocation stacks upon mempool_alloc()/mempool_free() either.
Why not?
> Therefore make kasan_[un]poison_element() just change the shadow memory,
> not the metadata.
>
> Signed-off-by: Alexander Potapenko <glider@google.com>
> Reported-by: Kuthonuzo Luruo <kuthonuzo.luruo@hpe.com>
> ---
[...]
> +void kasan_slab_alloc(struct kmem_cache *cache, void *object,
> + bool just_unpoison, gfp_t flags)
> {
> - kasan_kmalloc(cache, object, cache->object_size, flags);
> + if (just_unpoison)
This set to 'false' in all call sites.
> + kasan_unpoison_shadow(object, cache->object_size);
> + else
> + kasan_kmalloc(cache, object, cache->object_size, flags);
> }
>
> void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
> @@ -611,6 +615,31 @@ void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags)
> KASAN_PAGE_REDZONE);
> }
>
> +void kasan_unpoison_kmalloc(const void *object, size_t size, gfp_t flags)
> +{
> + struct page *page;
> + unsigned long redzone_start;
> + unsigned long redzone_end;
> +
> + if (unlikely(object == ZERO_SIZE_PTR) || (object == NULL))
> + return;
> +
> + page = virt_to_head_page(object);
> + redzone_start = round_up((unsigned long)(object + size),
> + KASAN_SHADOW_SCALE_SIZE);
> +
> + if (unlikely(!PageSlab(page)))
> + redzone_end = (unsigned long)object +
> + (PAGE_SIZE << compound_order(page));
> + else
> + redzone_end = round_up(
> + (unsigned long)object + page->slab_cache->object_size,
> + KASAN_SHADOW_SCALE_SIZE);
> + kasan_unpoison_shadow(object, size);
> + kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
> + KASAN_KMALLOC_REDZONE);
> +}
> +
> void kasan_krealloc(const void *object, size_t size, gfp_t flags)
> {
> struct page *page;
> @@ -636,7 +665,20 @@ void kasan_kfree(void *ptr)
> kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
> KASAN_FREE_PAGE);
> else
> - kasan_slab_free(page->slab_cache, ptr);
> + kasan_poison_slab_free(page->slab_cache, ptr);
> +}
> +
> +void kasan_poison_kfree(void *ptr)
Unused
> +{
> + struct page *page;
> +
> + page = virt_to_head_page(ptr);
> +
> + if (unlikely(!PageSlab(page)))
> + kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
> + KASAN_FREE_PAGE);
> + else
> + kasan_poison_slab_free(page->slab_cache, ptr);
> }
>
> void kasan_kfree_large(const void *ptr)
> diff --git a/mm/mempool.c b/mm/mempool.c
> index 9e075f8..bcd48c6 100644
> --- a/mm/mempool.c
> +++ b/mm/mempool.c
> @@ -115,9 +115,10 @@ static void kasan_poison_element(mempool_t *pool, void *element)
> static void kasan_unpoison_element(mempool_t *pool, void *element, gfp_t flags)
> {
> if (pool->alloc == mempool_alloc_slab)
> - kasan_slab_alloc(pool->pool_data, element, flags);
> + kasan_slab_alloc(pool->pool_data, element,
> + /*just_unpoison*/ false, flags);
> if (pool->alloc == mempool_kmalloc)
> - kasan_krealloc(element, (size_t)pool->pool_data, flags);
> + kasan_unpoison_kmalloc(element, (size_t)pool->pool_data, flags);
I think, that the current code here is fine.
We only need to fix kasan_poison_element() which calls kasan_kfree() that puts objects into quarantine.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] mm: mempool: kasan: don't poot mempool objects in quarantine
2016-06-01 16:22 ` Andrey Ryabinin
@ 2016-06-09 14:05 ` Andrey Ryabinin
2016-06-09 15:20 ` Alexander Potapenko
0 siblings, 1 reply; 4+ messages in thread
From: Andrey Ryabinin @ 2016-06-09 14:05 UTC (permalink / raw)
To: Alexander Potapenko, adech.fo, cl, dvyukov, akpm, rostedt,
iamjoonsoo.kim, js1304, kcc, kuthonuzo.luruo
Cc: kasan-dev, linux-mm, linux-kernel, Kuthonuzo Luruo
On 06/01/2016 07:22 PM, Andrey Ryabinin wrote:
>
>
> On 06/01/2016 03:53 PM, Alexander Potapenko wrote:
>> To avoid draining the mempools, KASAN shouldn't put the mempool elements
>> into the quarantine upon mempool_free().
>
> Correct, but unfortunately this patch doesn't fix that.
>
So, I made this:
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Subject: [PATCH] mm: mempool: kasan: don't poot mempool objects in quarantine
Currently we may put reserved by mempool elements into quarantine
via kasan_kfree(). This is totally wrong since quarantine may really
free these objects. So when mempool will try to use such element,
use-after-free will happen. Or mempool may decide that it no longer
need that element and double-free it.
So don't put object into quarantine in kasan_kfree(), just poison it.
Rename kasan_kfree() to kasan_poison_kfree() to respect that.
Also, we shouldn't use kasan_slab_alloc()/kasan_krealloc() in
kasan_unpoison_element() because those functions may update allocation
stacktrace. This would be wrong for the most of the remove_element
call sites.
(The only call site where we may want to update alloc stacktrace is
in mempool_alloc(). Kmemleak solves this by calling
kmemleak_update_trace(), so we could make something like that too.
But this is out of scope of this patch).
Fixes: 55834c59098d ("mm: kasan: initial memory quarantine implementation")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reported-by: Kuthonuzo Luruo <kuthonuzo.luruo@hpe.com>
---
include/linux/kasan.h | 11 +++++++----
mm/kasan/kasan.c | 6 +++---
mm/mempool.c | 12 ++++--------
3 files changed, 14 insertions(+), 15 deletions(-)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 611927f..ac4b3c4 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -59,14 +59,13 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object);
void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags);
void kasan_kfree_large(const void *ptr);
-void kasan_kfree(void *ptr);
+void kasan_poison_kfree(void *ptr);
void kasan_kmalloc(struct kmem_cache *s, const void *object, size_t size,
gfp_t flags);
void kasan_krealloc(const void *object, size_t new_size, gfp_t flags);
void kasan_slab_alloc(struct kmem_cache *s, void *object, gfp_t flags);
bool kasan_slab_free(struct kmem_cache *s, void *object);
-void kasan_poison_slab_free(struct kmem_cache *s, void *object);
struct kasan_cache {
int alloc_meta_offset;
@@ -76,6 +75,9 @@ struct kasan_cache {
int kasan_module_alloc(void *addr, size_t size);
void kasan_free_shadow(const struct vm_struct *vm);
+size_t ksize(const void *);
+static inline void kasan_unpoison_slab(const void *ptr) { ksize(ptr); }
+
#else /* CONFIG_KASAN */
static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
@@ -102,7 +104,7 @@ static inline void kasan_poison_object_data(struct kmem_cache *cache,
static inline void kasan_kmalloc_large(void *ptr, size_t size, gfp_t flags) {}
static inline void kasan_kfree_large(const void *ptr) {}
-static inline void kasan_kfree(void *ptr) {}
+static inline void kasan_poison_kfree(void *ptr) {}
static inline void kasan_kmalloc(struct kmem_cache *s, const void *object,
size_t size, gfp_t flags) {}
static inline void kasan_krealloc(const void *object, size_t new_size,
@@ -114,11 +116,12 @@ static inline bool kasan_slab_free(struct kmem_cache *s, void *object)
{
return false;
}
-static inline void kasan_poison_slab_free(struct kmem_cache *s, void *object) {}
static inline int kasan_module_alloc(void *addr, size_t size) { return 0; }
static inline void kasan_free_shadow(const struct vm_struct *vm) {}
+static inline void kasan_unpoison_slab(const void *ptr) { }
+
#endif /* CONFIG_KASAN */
#endif /* LINUX_KASAN_H */
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 28439ac..6845f92 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -508,7 +508,7 @@ void kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags)
kasan_kmalloc(cache, object, cache->object_size, flags);
}
-void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
+static void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
{
unsigned long size = cache->object_size;
unsigned long rounded_up_size = round_up(size, KASAN_SHADOW_SCALE_SIZE);
@@ -626,7 +626,7 @@ void kasan_krealloc(const void *object, size_t size, gfp_t flags)
kasan_kmalloc(page->slab_cache, object, size, flags);
}
-void kasan_kfree(void *ptr)
+void kasan_poison_kfree(void *ptr)
{
struct page *page;
@@ -636,7 +636,7 @@ void kasan_kfree(void *ptr)
kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
KASAN_FREE_PAGE);
else
- kasan_slab_free(page->slab_cache, ptr);
+ kasan_poison_slab_free(page->slab_cache, ptr);
}
void kasan_kfree_large(const void *ptr)
diff --git a/mm/mempool.c b/mm/mempool.c
index 9e075f8..8f65464 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -104,20 +104,16 @@ static inline void poison_element(mempool_t *pool, void *element)
static void kasan_poison_element(mempool_t *pool, void *element)
{
- if (pool->alloc == mempool_alloc_slab)
- kasan_poison_slab_free(pool->pool_data, element);
- if (pool->alloc == mempool_kmalloc)
- kasan_kfree(element);
+ if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
+ kasan_poison_kfree(element);
if (pool->alloc == mempool_alloc_pages)
kasan_free_pages(element, (unsigned long)pool->pool_data);
}
static void kasan_unpoison_element(mempool_t *pool, void *element, gfp_t flags)
{
- if (pool->alloc == mempool_alloc_slab)
- kasan_slab_alloc(pool->pool_data, element, flags);
- if (pool->alloc == mempool_kmalloc)
- kasan_krealloc(element, (size_t)pool->pool_data, flags);
+ if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
+ kasan_unpoison_slab(element);
if (pool->alloc == mempool_alloc_pages)
kasan_alloc_pages(element, (unsigned long)pool->pool_data);
}
--
2.7.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] mm: mempool: kasan: don't poot mempool objects in quarantine
2016-06-09 14:05 ` [PATCH] mm: mempool: kasan: don't poot mempool objects in quarantine Andrey Ryabinin
@ 2016-06-09 15:20 ` Alexander Potapenko
0 siblings, 0 replies; 4+ messages in thread
From: Alexander Potapenko @ 2016-06-09 15:20 UTC (permalink / raw)
To: Andrey Ryabinin
Cc: Andrey Konovalov, Christoph Lameter, Dmitriy Vyukov,
Andrew Morton, Steven Rostedt, Joonsoo Kim, Joonsoo Kim,
Kostya Serebryany, Kuthonuzo Luruo, kasan-dev,
Linux Memory Management List, LKML
On Thu, Jun 9, 2016 at 4:05 PM, Andrey Ryabinin <aryabinin@virtuozzo.com> wrote:
> On 06/01/2016 07:22 PM, Andrey Ryabinin wrote:
>>
>>
>> On 06/01/2016 03:53 PM, Alexander Potapenko wrote:
>>> To avoid draining the mempools, KASAN shouldn't put the mempool elements
>>> into the quarantine upon mempool_free().
>>
>> Correct, but unfortunately this patch doesn't fix that.
>>
>
> So, I made this:
You beat me to it :)
Thanks!
>
>
> From: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Subject: [PATCH] mm: mempool: kasan: don't poot mempool objects in quarantine
>
> Currently we may put reserved by mempool elements into quarantine
> via kasan_kfree(). This is totally wrong since quarantine may really
> free these objects. So when mempool will try to use such element,
> use-after-free will happen. Or mempool may decide that it no longer
> need that element and double-free it.
>
> So don't put object into quarantine in kasan_kfree(), just poison it.
> Rename kasan_kfree() to kasan_poison_kfree() to respect that.
>
> Also, we shouldn't use kasan_slab_alloc()/kasan_krealloc() in
> kasan_unpoison_element() because those functions may update allocation
> stacktrace. This would be wrong for the most of the remove_element
> call sites.
>
> (The only call site where we may want to update alloc stacktrace is
> in mempool_alloc(). Kmemleak solves this by calling
> kmemleak_update_trace(), so we could make something like that too.
> But this is out of scope of this patch).
>
> Fixes: 55834c59098d ("mm: kasan: initial memory quarantine implementation")
> Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Reported-by: Kuthonuzo Luruo <kuthonuzo.luruo@hpe.com>
Acked-by: Alexander Potapenko <glider@google.com>
> ---
> include/linux/kasan.h | 11 +++++++----
> mm/kasan/kasan.c | 6 +++---
> mm/mempool.c | 12 ++++--------
> 3 files changed, 14 insertions(+), 15 deletions(-)
>
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index 611927f..ac4b3c4 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> @@ -59,14 +59,13 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object);
>
> void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags);
> void kasan_kfree_large(const void *ptr);
> -void kasan_kfree(void *ptr);
> +void kasan_poison_kfree(void *ptr);
> void kasan_kmalloc(struct kmem_cache *s, const void *object, size_t size,
> gfp_t flags);
> void kasan_krealloc(const void *object, size_t new_size, gfp_t flags);
>
> void kasan_slab_alloc(struct kmem_cache *s, void *object, gfp_t flags);
> bool kasan_slab_free(struct kmem_cache *s, void *object);
> -void kasan_poison_slab_free(struct kmem_cache *s, void *object);
>
> struct kasan_cache {
> int alloc_meta_offset;
> @@ -76,6 +75,9 @@ struct kasan_cache {
> int kasan_module_alloc(void *addr, size_t size);
> void kasan_free_shadow(const struct vm_struct *vm);
>
> +size_t ksize(const void *);
> +static inline void kasan_unpoison_slab(const void *ptr) { ksize(ptr); }
> +
> #else /* CONFIG_KASAN */
>
> static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
> @@ -102,7 +104,7 @@ static inline void kasan_poison_object_data(struct kmem_cache *cache,
>
> static inline void kasan_kmalloc_large(void *ptr, size_t size, gfp_t flags) {}
> static inline void kasan_kfree_large(const void *ptr) {}
> -static inline void kasan_kfree(void *ptr) {}
> +static inline void kasan_poison_kfree(void *ptr) {}
> static inline void kasan_kmalloc(struct kmem_cache *s, const void *object,
> size_t size, gfp_t flags) {}
> static inline void kasan_krealloc(const void *object, size_t new_size,
> @@ -114,11 +116,12 @@ static inline bool kasan_slab_free(struct kmem_cache *s, void *object)
> {
> return false;
> }
> -static inline void kasan_poison_slab_free(struct kmem_cache *s, void *object) {}
>
> static inline int kasan_module_alloc(void *addr, size_t size) { return 0; }
> static inline void kasan_free_shadow(const struct vm_struct *vm) {}
>
> +static inline void kasan_unpoison_slab(const void *ptr) { }
> +
> #endif /* CONFIG_KASAN */
>
> #endif /* LINUX_KASAN_H */
> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
> index 28439ac..6845f92 100644
> --- a/mm/kasan/kasan.c
> +++ b/mm/kasan/kasan.c
> @@ -508,7 +508,7 @@ void kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags)
> kasan_kmalloc(cache, object, cache->object_size, flags);
> }
>
> -void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
> +static void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
> {
> unsigned long size = cache->object_size;
> unsigned long rounded_up_size = round_up(size, KASAN_SHADOW_SCALE_SIZE);
> @@ -626,7 +626,7 @@ void kasan_krealloc(const void *object, size_t size, gfp_t flags)
> kasan_kmalloc(page->slab_cache, object, size, flags);
> }
>
> -void kasan_kfree(void *ptr)
> +void kasan_poison_kfree(void *ptr)
> {
> struct page *page;
>
> @@ -636,7 +636,7 @@ void kasan_kfree(void *ptr)
> kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
> KASAN_FREE_PAGE);
> else
> - kasan_slab_free(page->slab_cache, ptr);
> + kasan_poison_slab_free(page->slab_cache, ptr);
> }
>
> void kasan_kfree_large(const void *ptr)
> diff --git a/mm/mempool.c b/mm/mempool.c
> index 9e075f8..8f65464 100644
> --- a/mm/mempool.c
> +++ b/mm/mempool.c
> @@ -104,20 +104,16 @@ static inline void poison_element(mempool_t *pool, void *element)
>
> static void kasan_poison_element(mempool_t *pool, void *element)
> {
> - if (pool->alloc == mempool_alloc_slab)
> - kasan_poison_slab_free(pool->pool_data, element);
> - if (pool->alloc == mempool_kmalloc)
> - kasan_kfree(element);
> + if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
> + kasan_poison_kfree(element);
> if (pool->alloc == mempool_alloc_pages)
> kasan_free_pages(element, (unsigned long)pool->pool_data);
> }
>
> static void kasan_unpoison_element(mempool_t *pool, void *element, gfp_t flags)
> {
> - if (pool->alloc == mempool_alloc_slab)
> - kasan_slab_alloc(pool->pool_data, element, flags);
> - if (pool->alloc == mempool_kmalloc)
> - kasan_krealloc(element, (size_t)pool->pool_data, flags);
> + if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
> + kasan_unpoison_slab(element);
> if (pool->alloc == mempool_alloc_pages)
> kasan_alloc_pages(element, (unsigned long)pool->pool_data);
> }
> --
> 2.7.3
>
>
--
Alexander Potapenko
Software Engineer
Google Germany GmbH
Erika-Mann-Straße, 33
80636 München
Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-06-09 15:20 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-01 12:53 [PATCH] mm: kasan: don't touch metadata in kasan_[un]poison_element() Alexander Potapenko
2016-06-01 16:22 ` Andrey Ryabinin
2016-06-09 14:05 ` [PATCH] mm: mempool: kasan: don't poot mempool objects in quarantine Andrey Ryabinin
2016-06-09 15:20 ` Alexander Potapenko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).