Re: [PATCH 2/3] kasan: avoid re-poisoning tag-based kmalloc redzones

[Dev Jain]

> 
> Problem 1:
> 
> p = kzalloc(96, GFP_KERNEL);                 // kmalloc-128
> p = krealloc(p, 120, GFP_KERNEL | __GFP_ZERO);
> 
> Before my patch, kzalloc zeroed bytes 0..127, krealloc exposes bytes 96..119
> which are already zero from kzalloc.
> 
> After my patch, kzalloc zeroes only 0..95, krealloc may think old
> size is 128, so it does not zero 96..119, 96..119 may contain stale data.
> 
> Why is this a problem? Surely caller of krealloc shouldn't be
> relying on a previous zeroing. krealloc documentation explicitly says that
> GFP_ZERO is ignored.


My bad for looking at a very old tree :( the documentation in the upstream
kernel does not say that.