A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 18:51:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

kasan: detect invalid frees for large objects

Browse source 
Patch series "kasan: detect invalid frees".

KASAN detects double-frees, but does not detect invalid-frees (when a
pointer into a middle of heap object is passed to free).  We recently had
a very unpleasant case in crypto code which freed an inner object inside
of a heap allocation.  This left unnoticed during free, but totally
corrupted heap and later lead to a bunch of random crashes all over kernel
code.

Detect invalid frees.

This patch (of 5):

Detect frees of pointers into middle of large heap objects.

I dropped const from kasan_kfree_large() because it starts propagating
through a bunch of functions in kasan_report.c, slab/slub nearest_obj(),
all of their local variables, fixup_red_left(), etc.

Link: http://lkml.kernel.org/r/1b45b4fe1d20fc0de1329aab674c1dd973fee723.1514378558.git.dvyukov@google.com
Signed-off-by: Dmitry Vyukov <[email protected]>
Cc: Andrey Ryabinin <[email protected]>a
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
Dmitry Vyukov 2018-02-06 15:36:23 -08:00 • committed by Linus Torvalds
commit 47adccce3e
6 changed files with 44 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

12
mm/kasan/kasan.c
View file

@ -511,8 +511,7 @@ bool kasan_slab_free(struct kmem_cache *cache, void *object)
shadow_byte = READ_ONCE(*(s8 *)kasan_mem_to_shadow(object));
if (shadow_byte < 0 || shadow_byte >= KASAN_SHADOW_SCALE_SIZE) {
kasan_report_double_free(cache, object,
__builtin_return_address(1));
kasan_report_invalid_free(object, __builtin_return_address(1));
return true;
}
@ -602,12 +601,11 @@ void kasan_poison_kfree(void *ptr)
kasan_poison_slab_free(page->slab_cache, ptr);
}
void kasan_kfree_large(const void *ptr)
void kasan_kfree_large(void *ptr)
{
struct page *page = virt_to_page(ptr);
kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
KASAN_FREE_PAGE);
if (ptr != page_address(virt_to_head_page(ptr)))
kasan_report_invalid_free(ptr, __builtin_return_address(1));
/* The object will be poisoned by page_alloc. */
}
int kasan_module_alloc(void *addr, size_t size)

3
mm/kasan/kasan.h
View file

@ -107,8 +107,7 @@ static inline const void *kasan_shadow_to_mem(const void *shadow_addr)
void kasan_report(unsigned long addr, size_t size,
bool is_write, unsigned long ip);
void kasan_report_double_free(struct kmem_cache *cache, void *object,
void *ip);
void kasan_report_invalid_free(void *object, void *ip);
#if defined(CONFIG_SLAB) || defined(CONFIG_SLUB)
void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache);

3
mm/kasan/report.c
View file

@ -326,8 +326,7 @@ static void print_shadow_for_address(const void *addr)
}
}
void kasan_report_double_free(struct kmem_cache *cache, void *object,
void *ip)
void kasan_report_invalid_free(void *object, void *ip)
{
unsigned long flags;

4
mm/slub.c
View file

@ -1356,7 +1356,7 @@ static inline void kmalloc_large_node_hook(void *ptr, size_t size, gfp_t flags)
kasan_kmalloc_large(ptr, size, flags);
}
static inline void kfree_hook(const void *x)
static inline void kfree_hook(void *x)
{
kmemleak_free(x);
kasan_kfree_large(x);
@ -3910,7 +3910,7 @@ void kfree(const void *x)
page = virt_to_head_page(x);
if (unlikely(!PageSlab(page))) {
BUG_ON(!PageCompound(page));
kfree_hook(x);
kfree_hook(object);
__free_pages(page, compound_order(page));
return;
}