Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1353860 > unrolled thread
| Started by | Matthew Dawson <matthew@mjdsystems.ca> |
|---|---|
| First post | 2016-03-09 07:30 +0100 |
| Last post | 2016-03-10 15:00 +0100 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] mm/mempool: Avoid KASAN marking mempool posion checks as use-after-free Matthew Dawson <matthew@mjdsystems.ca> - 2016-03-09 07:30 +0100
Re: [PATCH] mm/mempool: Avoid KASAN marking mempool posion checks as use-after-free Andrey Ryabinin <aryabinin@virtuozzo.com> - 2016-03-10 15:00 +0100
| From | Matthew Dawson <matthew@mjdsystems.ca> |
|---|---|
| Date | 2016-03-09 07:30 +0100 |
| Subject | [PATCH] mm/mempool: Avoid KASAN marking mempool posion checks as use-after-free |
| Message-ID | <raFN8-41M-15@gated-at.bofh.it> |
When removing an element from the mempool, mark it as unpoisoned in KASAN before verifying its contents for SLUB/SLAB debugging. Otherwise KASAN will flag the reads checking the element use-after-free writes as use-after-free reads. Signed-off-by: Matthew Dawson <matthew@mjdsystems.ca> --- mm/mempool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/mempool.c b/mm/mempool.c index 004d42b..7924f4f 100644 --- a/mm/mempool.c +++ b/mm/mempool.c @@ -135,8 +135,8 @@ static void *remove_element(mempool_t *pool) void *element = pool->elements[--pool->curr_nr]; BUG_ON(pool->curr_nr < 0); - check_element(pool, element); kasan_unpoison_element(pool, element); + check_element(pool, element); return element; } -- 2.7.1
[toc] | [next] | [standalone]
| From | Andrey Ryabinin <aryabinin@virtuozzo.com> |
|---|---|
| Date | 2016-03-10 15:00 +0100 |
| Subject | Re: [PATCH] mm/mempool: Avoid KASAN marking mempool posion checks as use-after-free |
| Message-ID | <rb9i9-7Ja-5@gated-at.bofh.it> |
| In reply to | #1353860 |
On 03/09/2016 09:16 AM, Matthew Dawson wrote: > When removing an element from the mempool, mark it as unpoisoned in KASAN > before verifying its contents for SLUB/SLAB debugging. Otherwise KASAN > will flag the reads checking the element use-after-free writes as > use-after-free reads. > > Signed-off-by: Matthew Dawson <matthew@mjdsystems.ca> Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web