Commit 0ab686d8 authored by Joonsoo Kim's avatar Joonsoo Kim Committed by Linus Torvalds

kasan/quarantine: fix bugs on qlist_move_cache()

There are two bugs on qlist_move_cache().  One is that qlist's tail
isn't set properly.  curr->next can be NULL since it is singly linked
list and NULL value on tail is invalid if there is one item on qlist.
Another one is that if cache is matched, qlist_put() is called and it
will set curr->next to NULL.  It would cause to stop the loop
prematurely.

These problems come from complicated implementation so I'd like to
re-implement it completely.  Implementation in this patch is really
simple.  Iterate all qlist_nodes and put them to appropriate list.

Unfortunately, I got this bug sometime ago and lose oops message.  But,
the bug looks trivial and no need to attach oops.

Fixes: 55834c59 ("mm: kasan: initial memory quarantine implementation")
Link: http://lkml.kernel.org/r/1467766348-22419-1-git-send-email-iamjoonsoo.kim@lge.comSigned-off-by: default avatarJoonsoo Kim <iamjoonsoo.kim@lge.com>
Reviewed-by: default avatarDmitry Vyukov <dvyukov@google.com>
Acked-by: default avatarAndrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: default avatarAlexander Potapenko <glider@google.com>
Cc: Kuthonuzo Luruo <poll.stdin@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 12cb22bb
...@@ -238,30 +238,23 @@ static void qlist_move_cache(struct qlist_head *from, ...@@ -238,30 +238,23 @@ static void qlist_move_cache(struct qlist_head *from,
struct qlist_head *to, struct qlist_head *to,
struct kmem_cache *cache) struct kmem_cache *cache)
{ {
struct qlist_node *prev = NULL, *curr; struct qlist_node *curr;
if (unlikely(qlist_empty(from))) if (unlikely(qlist_empty(from)))
return; return;
curr = from->head; curr = from->head;
qlist_init(from);
while (curr) { while (curr) {
struct qlist_node *qlink = curr; struct qlist_node *next = curr->next;
struct kmem_cache *obj_cache = qlink_to_cache(qlink); struct kmem_cache *obj_cache = qlink_to_cache(curr);
if (obj_cache == cache) { if (obj_cache == cache)
if (unlikely(from->head == qlink)) { qlist_put(to, curr, obj_cache->size);
from->head = curr->next; else
prev = curr; qlist_put(from, curr, obj_cache->size);
} else
prev->next = curr->next; curr = next;
if (unlikely(from->tail == qlink))
from->tail = curr->next;
from->bytes -= cache->size;
qlist_put(to, qlink, cache->size);
} else {
prev = curr;
}
curr = curr->next;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment