Re: [PATCH] mm, mempool: kasan: poison mempool elements

From: Andrew Morton
Date: Fri Apr 03 2015 - 18:07:28 EST

On Fri, 03 Apr 2015 17:47:47 +0300 Andrey Ryabinin <a.ryabinin@xxxxxxxxxxx> wrote:

> Mempools keep allocated objects in reserved for situations
> when ordinary allocation may not be possible to satisfy.
> These objects shouldn't be accessed before they leave
> the pool.
> This patch poison elements when get into the pool
> and unpoison when they leave it. This will let KASan
> to detect use-after-free of mempool's elements.
> ...
> +static void kasan_poison_element(mempool_t *pool, void *element)
> +{
> + if (pool->alloc == mempool_alloc_slab)
> + kasan_slab_free(pool->pool_data, element);
> + if (pool->alloc == mempool_kmalloc)
> + kasan_kfree(element);
> + if (pool->alloc == mempool_alloc_pages)
> + kasan_free_pages(element, (unsigned long)pool->pool_data);
> +}

We recently discovered that mempool pages (from alloc_pages, not slab)
can be in highmem. But kasan apepars to handle highmem pages (by
baling out) so we should be OK with that.

Can kasan be taught to use kmap_atomic() or is it more complicated than
that? It probably isn't worthwhile - highmem pages don'[t get used by the
kernel much and most bugs will be found using 64-bit testing anyway.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at