Re: [PATCH] kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED

From: Qian Cai
Date: Wed Feb 13 2019 - 20:56:31 EST

On 2/13/19 7:27 PM, Andrey Konovalov wrote:
> On Thu, Feb 14, 2019 at 1:25 AM Andrey Konovalov <andreyknvl@xxxxxxxxxx> wrote:
>> When CONFIG_KASAN_SW_TAGS is enabled, ptr_addr might be tagged.
>> Normally, this doesn't cause any issues, as both set_freepointer()
>> and get_freepointer() are called with a pointer with the same tag.
>> However, there are some issues with CONFIG_SLUB_DEBUG code. For
>> example, when __free_slub() iterates over objects in a cache, it
>> passes untagged pointers to check_object(). check_object() in turns
>> calls get_freepointer() with an untagged pointer, which causes the
>> freepointer to be restored incorrectly.
>> Add kasan_reset_tag to freelist_ptr(). Also add a detailed comment.
>> Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx>
> Reported-by: Qian Cai <cai@xxxxxx>

Tested-by: Qian Cai <cai@xxxxxx>