Commit b556a462 authored by Andrey Konovalov's avatar Andrey Konovalov Committed by Andrew Morton
Browse files

kasan: save free stack traces for slab mempools 

Make kasan_mempool_poison_object save free stack traces for slab and
kmalloc mempools when the object is freed into the mempool.

Also simplify and rename ____kasan_slab_free to poison_slab_object and do
a few other reability changes.

Link: https://lkml.kernel.org/r/413a7c7c3344fb56809853339ffaabc9e4905e94.1703024586.git.andreyknvl@google.com


Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Cc: Alexander Lobakin <alobakin@pm.me>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Breno Leitao <leitao@debian.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Marco Elver <elver@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent cf0da2af

include/linux/kasan.h

+3 −2
Original line number Diff line number Diff line
@@ -268,8 +268,9 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip); 
 * to reuse them instead of freeing them back to the slab allocator (e.g.

 * mempool).

 *

 * This function poisons a slab allocation without initializing its memory and

 * without putting it into the quarantine (for the Generic mode).

 * This function poisons a slab allocation and saves a free stack trace for it

 * without initializing the allocation's memory and without putting it into the

 * quarantine (for the Generic mode).

 *

 * This function also performs checks to detect double-free and invalid-free

 * bugs and reports them. The caller can use the return value of this function

mm/kasan/common.c

+9 −11
Original line number Diff line number Diff line
@@ -207,8 +207,8 @@ void * __must_check __kasan_init_slab_obj(struct kmem_cache *cache, 
	return (void *)object;

}



static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object,

				unsigned long ip, bool quarantine, bool init)

static inline bool poison_slab_object(struct kmem_cache *cache, void *object,

				      unsigned long ip, bool init)

{

	void *tagged_object;
@@ -221,13 +221,12 @@ static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, 
	if (is_kfence_address(object))

		return false;



	if (unlikely(nearest_obj(cache, virt_to_slab(object), object) !=

	    object)) {

	if (unlikely(nearest_obj(cache, virt_to_slab(object), object) != object)) {

		kasan_report_invalid_free(tagged_object, ip, KASAN_REPORT_INVALID_FREE);

		return true;

	}



	/* RCU slabs could be legally used after free within the RCU period */

	/* RCU slabs could be legally used after free within the RCU period. */

	if (unlikely(cache->flags & SLAB_TYPESAFE_BY_RCU))

		return false;
@@ -239,19 +238,18 @@ static inline bool ____kasan_slab_free(struct kmem_cache *cache, void *object, 
	kasan_poison(object, round_up(cache->object_size, KASAN_GRANULE_SIZE),

			KASAN_SLAB_FREE, init);



	if ((IS_ENABLED(CONFIG_KASAN_GENERIC) && !quarantine))

		return false;



	if (kasan_stack_collection_enabled())

		kasan_save_free_info(cache, tagged_object);



	return kasan_quarantine_put(cache, object);

	return false;

}



bool __kasan_slab_free(struct kmem_cache *cache, void *object,

				unsigned long ip, bool init)

{

	return ____kasan_slab_free(cache, object, ip, true, init);

	bool buggy_object = poison_slab_object(cache, object, ip, init);



	return buggy_object ? true : kasan_quarantine_put(cache, object);

}



static inline bool check_page_allocation(void *ptr, unsigned long ip)
@@ -472,7 +470,7 @@ bool __kasan_mempool_poison_object(void *ptr, unsigned long ip) 
	}



	slab = folio_slab(folio);

	return !____kasan_slab_free(slab->slab_cache, ptr, ip, false, false);

	return !poison_slab_object(slab->slab_cache, ptr, ip, false);

}



void __kasan_mempool_unpoison_object(void *ptr, size_t size, unsigned long ip)