]> www.infradead.org Git - users/jedix/linux-maple.git/commit
kasan: catch invalid free before SLUB reinitializes the object
authorJann Horn <jannh@google.com>
Fri, 9 Aug 2024 15:36:55 +0000 (17:36 +0200)
committerVlastimil Babka <vbabka@suse.cz>
Tue, 27 Aug 2024 12:12:51 +0000 (14:12 +0200)
commitb3c34245756adada8a50bdaedbb3965b071c7b0a
tree8b6cff494f8b7bbd9c5698f43393644df1ae6710
parent4e1c44b3db79ba910adec32e2e1b920a0e34890a
kasan: catch invalid free before SLUB reinitializes the object

Currently, when KASAN is combined with init-on-free behavior, the
initialization happens before KASAN's "invalid free" checks.

More importantly, a subsequent commit will want to RCU-delay the actual
SLUB freeing of an object, and we'd like KASAN to still validate
synchronously that freeing the object is permitted. (Otherwise this
change will make the existing testcase kmem_cache_invalid_free fail.)

So add a new KASAN hook that allows KASAN to pre-validate a
kmem_cache_free() operation before SLUB actually starts modifying the
object or its metadata.

Inside KASAN, this:

 - moves checks from poison_slab_object() into check_slab_allocation()
 - moves kasan_arch_is_ready() up into callers of poison_slab_object()
 - removes "ip" argument of poison_slab_object() and __kasan_slab_free()
   (since those functions no longer do any reporting)

Acked-by: Vlastimil Babka <vbabka@suse.cz> #slub
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
include/linux/kasan.h
mm/kasan/common.c
mm/slub.c