From patchwork Sun May 23 00:41:56 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 12274709 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1F53C2B9F2 for ; Sun, 23 May 2021 00:41:59 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6AF806052B for ; Sun, 23 May 2021 00:41:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6AF806052B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0FE1D8E0095; Sat, 22 May 2021 20:41:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 0D72D8E007F; Sat, 22 May 2021 20:41:59 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F06888E0095; Sat, 22 May 2021 20:41:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0106.hostedemail.com [216.40.44.106]) by kanga.kvack.org (Postfix) with ESMTP id BE4C28E007F for ; Sat, 22 May 2021 20:41:58 -0400 (EDT) Received: from smtpin20.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 5DC2512D8 for ; Sun, 23 May 2021 00:41:58 +0000 (UTC) X-FDA: 78170643516.20.2629F33 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf06.hostedemail.com (Postfix) with ESMTP id E7204C0007C7 for ; Sun, 23 May 2021 00:41:53 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id ADBF3611AB; Sun, 23 May 2021 00:41:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1621730517; bh=FC0nVeOsbN/Gx418s9w8V/+WirPHgOkJCT6LD6MsUI4=; h=Date:From:To:Subject:In-Reply-To:From; b=dSiMfGtZo5CXL6AxsihSa4ADAr0t0XfMvVyi/25c+uSoPlmwua2CvKRmmq94UzjeB BnBuw4c10nvAxyd0u7Xmx/11I38khs5KJPyOiNeqc6GzAYk9bagxk88eDeLRVVMgoK QISrD+J/ad/P/WkdEbArBGmf/iSeH9ZSI27EKLUM= Date: Sat, 22 May 2021 17:41:56 -0700 From: Andrew Morton To: akpm@linux-foundation.org, andreyknvl@gmail.com, aryabinin@virtuozzo.com, eberman@codeaurora.org, elver@google.com, glider@google.com, linux-mm@kvack.org, mm-commits@vger.kernel.org, torvalds@linux-foundation.org, vincenzo.frascino@arm.com Subject: [patch 05/10] kasan: slab: always reset the tag in get_freepointer_safe() Message-ID: <20210523004156.1-UnZ7NxI%akpm@linux-foundation.org> In-Reply-To: <20210522174113.47fd4c853c0a1470c57deefa@linux-foundation.org> User-Agent: s-nail v14.8.16 Authentication-Results: imf06.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=dSiMfGtZ; spf=pass (imf06.hostedemail.com: domain of akpm@linux-foundation.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org; dmarc=none X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: E7204C0007C7 X-Stat-Signature: 4c3kjub7jdwbaeq9pyjawukyydny49nu X-HE-Tag: 1621730513-559136 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Alexander Potapenko Subject: kasan: slab: always reset the tag in get_freepointer_safe() With CONFIG_DEBUG_PAGEALLOC enabled, the kernel should also untag the object pointer, as done in get_freepointer(). Failing to do so reportedly leads to SLUB freelist corruptions that manifest as boot-time crashes. Link: https://lkml.kernel.org/r/20210514072228.534418-1-glider@google.com Signed-off-by: Alexander Potapenko Cc: Marco Elver Cc: Vincenzo Frascino Cc: Andrey Ryabinin Cc: Andrey Konovalov Cc: Elliot Berman Signed-off-by: Andrew Morton --- mm/slub.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/slub.c~kasan-slab-always-reset-the-tag-in-get_freepointer_safe +++ a/mm/slub.c @@ -301,6 +301,7 @@ static inline void *get_freepointer_safe if (!debug_pagealloc_enabled_static()) return get_freepointer(s, object); + object = kasan_reset_tag(object); freepointer_addr = (unsigned long)object + s->offset; copy_from_kernel_nofault(&p, (void **)freepointer_addr, sizeof(p)); return freelist_ptr(s, p, freepointer_addr);