[v3,2/3] kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY
diff mbox series

Message ID 7e756a298d514c4482f52aea6151db34818d395d.1546540962.git.andreyknvl@google.com
State Not Applicable, archived
Headers show
Series
  • kasan: tag-based mode fixes
Related show

Commit Message

Andrey Konovalov Jan. 3, 2019, 6:45 p.m. UTC
With CONFIG_HARDENED_USERCOPY enabled __check_heap_object() compares and
then subtracts a potentially tagged pointer with a non-tagged address of
the page that this pointer belongs to, which leads to unexpected behavior.

Untag the pointer in __check_heap_object() before doing any of these
operations.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
 mm/slub.c | 2 ++
 1 file changed, 2 insertions(+)

Patch
diff mbox series

diff --git a/mm/slub.c b/mm/slub.c
index 36c0befeebd8..1e3d0ec4e200 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3846,6 +3846,8 @@  void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 	unsigned int offset;
 	size_t object_size;
 
+	ptr = kasan_reset_tag(ptr);
+
 	/* Find object and usable object size. */
 	s = page->slab_cache;