diff options
| author | Vlastimil Babka <vbabka@suse.cz> | 2022-11-11 09:08:18 +0100 |
|---|---|---|
| committer | Vlastimil Babka <vbabka@suse.cz> | 2022-11-21 10:36:09 +0100 |
| commit | 90e9b23a60d5b4c8317f58e01ed05d3bdf063440 (patch) | |
| tree | b87f0bd1d2c0ab251fafcbc4aebd5e3c73799397 /mm/kasan/generic.c | |
| parent | 76537db3b95cbf5d0189ce185c16db9f93017021 (diff) | |
| parent | 946fa0dbf2d8923a587f7348adf16563d59f1b3d (diff) | |
| download | linux-90e9b23a60d5b4c8317f58e01ed05d3bdf063440.tar.gz | |
Merge branch 'slab/for-6.2/kmalloc_redzone' into slab/for-next
kmalloc() redzone improvements by Feng Tang
From cover letter [1]:
kmalloc's API family is critical for mm, and one of its nature is that
it will round up the request size to a fixed one (mostly power of 2).
When user requests memory for '2^n + 1' bytes, actually 2^(n+1) bytes
could be allocated, so there is an extra space than what is originally
requested.
This patchset tries to extend the redzone sanity check to the extra
kmalloced buffer than requested, to better detect un-legitimate access
to it. (depends on SLAB_STORE_USER & SLAB_RED_ZONE)
[1] https://lore.kernel.org/all/20221021032405.1825078-1-feng.tang@intel.com/
Diffstat (limited to 'mm/kasan/generic.c')
| -rw-r--r-- | mm/kasan/generic.c | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c index d8b5590f9484..b076f597a378 100644 --- a/mm/kasan/generic.c +++ b/mm/kasan/generic.c @@ -450,15 +450,22 @@ void kasan_init_object_meta(struct kmem_cache *cache, const void *object) __memset(alloc_meta, 0, sizeof(*alloc_meta)); } -size_t kasan_metadata_size(struct kmem_cache *cache) +size_t kasan_metadata_size(struct kmem_cache *cache, bool in_object) { + struct kasan_cache *info = &cache->kasan_info; + if (!kasan_requires_meta()) return 0; - return (cache->kasan_info.alloc_meta_offset ? - sizeof(struct kasan_alloc_meta) : 0) + - ((cache->kasan_info.free_meta_offset && - cache->kasan_info.free_meta_offset != KASAN_NO_FREE_META) ? - sizeof(struct kasan_free_meta) : 0); + + if (in_object) + return (info->free_meta_offset ? + 0 : sizeof(struct kasan_free_meta)); + else + return (info->alloc_meta_offset ? + sizeof(struct kasan_alloc_meta) : 0) + + ((info->free_meta_offset && + info->free_meta_offset != KASAN_NO_FREE_META) ? + sizeof(struct kasan_free_meta) : 0); } static void __kasan_record_aux_stack(void *addr, bool can_alloc) |