kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED
authorAndrey Konovalov <andreyknvl@google.com>
Thu, 21 Feb 2019 06:19:32 +0000 (22:19 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Thu, 21 Feb 2019 17:01:00 +0000 (09:01 -0800)
commitd36a63a943e37081e92e4abdf4a207fd2e83a006
tree148469fb82f7151fc255e9b449e0ef4629b574ca
parent18e506610238eda2b0c5a19a123d3d6ec0ab2de6
kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED

When CONFIG_KASAN_SW_TAGS is enabled, ptr_addr might be tagged.  Normally,
this doesn't cause any issues, as both set_freepointer() and
get_freepointer() are called with a pointer with the same tag.  However,
there are some issues with CONFIG_SLUB_DEBUG code.  For example, when
__free_slub() iterates over objects in a cache, it passes untagged
pointers to check_object().  check_object() in turns calls
get_freepointer() with an untagged pointer, which causes the freepointer
to be restored incorrectly.

Add kasan_reset_tag to freelist_ptr(). Also add a detailed comment.

Link: http://lkml.kernel.org/r/bf858f26ef32eb7bd24c665755b3aee4bc58d0e4.1550103861.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reported-by: Qian Cai <cai@lca.pw>
Tested-by: Qian Cai <cai@lca.pw>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/slub.c