• Andrey Konovalov's avatar
    slub, kasan: improve interaction of KASAN and slub_debug poisoning · 2d552463
    Andrey Konovalov authored
    When both KASAN and slub_debug are enabled, when a free object is being
    prepared in setup_object, slub_debug poisons the object data before KASAN
    initializes its per-object metadata.
    
    Right now, in setup_object, KASAN only initializes the alloc metadata,
    which is always stored outside of the object.  slub_debug is aware of this
    and it skips poisoning and checking that memory area.
    
    However, with the following patch in this series, KASAN also starts
    initializing its free medata in setup_object.  As this metadata might be
    stored within the object, this initialization might overwrite the
    slub_debug poisoning.  This leads to slub_debug reports.
    
    Thus, skip checking slub_debug poisoning of the object data area that
    overlaps with the in-object KASAN free metadata.
    
    Also make slub_debug poisoning of tail kmalloc redzones more precise when
    KASAN is enabled: slub_debug can still poison and check the tail kmalloc
    allocation area that comes after the KASAN free metadata.
    
    Link: https://lkml.kernel.org/r/20231122231202.121277-1-andrey.konovalov@linux.devSigned-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Tested-by: default avatarHyeonggon Yoo <42.hyeyoo@gmail.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Evgenii Stepanov <eugenis@google.com>
    Cc: Feng Tang <feng.tang@intel.com>
    Cc: Marco Elver <elver@google.com>
    Cc: Oscar Salvador <osalvador@suse.de>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    2d552463
slub.c 162 KB