kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY [Linux 5.0]

kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY [Linux 5.0]

This Linux kernel change "kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY" is included in the Linux 5.0 release. This change is authored by Andrey Konovalov <andreyknvl [at] google.com> on Wed Feb 20 22:20:25 2019 -0800. The commit for this change in Linux stable tree is 219667c (patch).

kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY

Similarly to commit 96fedce27e13 ("kasan: make tag based mode work with
CONFIG_HARDENED_USERCOPY"), we need to reset pointer tags in
__check_heap_object() in mm/slab.c before doing any pointer math.

Link: http://lkml.kernel.org/r/9a5[email protected]google.com
Signed-off-by: Andrey Konovalov <[email protected]>
Tested-by: Qian Cai <[email protected]>
Cc: Alexander Potapenko <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Catalin Marinas <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: Evgeniy Stepanov <[email protected]>
Cc: Kostya Serebryany <[email protected]>
Cc: Vincenzo Frascino <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

There are 2 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 mm/slab.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/slab.c b/mm/slab.c
index 78eb8c5..c844582 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4408,6 +4408,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
    unsigned int objnr;
    unsigned long offset;

+   ptr = kasan_reset_tag(ptr);
+
    /* Find and validate object. */
    cachep = page->slab_cache;
    objnr = obj_to_index(cachep, page, (void *)ptr);

Leave a Reply

Your email address will not be published. Required fields are marked *