kasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU
authorAndrey Konovalov <andreyknvl@google.com>
Fri, 28 Dec 2018 08:30:23 +0000 (00:30 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 28 Dec 2018 20:11:43 +0000 (12:11 -0800)
commit4d176711ea7a8d4873e7157ac6ab242ade3ba351
treed3612e442e860eae9f7130add02612507d9c0776
parente71fe3f921aeb27f0c65ee7ebfdde7f8c7d60b74
kasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU

An object constructor can initialize pointers within this objects based on
the address of the object.  Since the object address might be tagged, we
need to assign a tag before calling constructor.

The implemented approach is to assign tags to objects with constructors
when a slab is allocated and call constructors once as usual.  The
downside is that such object would always have the same tag when it is
reallocated, so we won't catch use-after-frees on it.

Also pressign tags for objects from SLAB_TYPESAFE_BY_RCU caches, since
they can be validy accessed after having been freed.

Link: http://lkml.kernel.org/r/f158a8a74a031d66f0a9398a5b0ed453c37ba09a.1544099024.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/slab.c
mm/slub.c