Messages in this thread | | | Date | Tue, 8 Sep 2015 13:05:34 +0300 | Subject | Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() | From | Andrey Ryabinin <> |
| |
2015-09-08 12:52 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>: > On 2015/9/8 17:49, Xishi Qiu wrote: > >> On 2015/9/8 17:36, Andrey Ryabinin wrote: >> >>> 2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>: >>>> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow >>>> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but >>>> it calculates wrong, so fix it. >>>> >>> >>> Please, be more specific. Describe what is wrong with the current code and why, >>> what's the effect of this bug and how you fixed it. >>> >>> >> >> If the 16 bytes memory is aligned on 8, then the shadow takes only 2 bytes. >> So we check "shadow_first_bytes" is enough, and need not to call "memory_is_poisoned_1(addr + 15);". >> The code "if (likely(IS_ALIGNED(addr, 8)))" is wrong judgement. > > Sorry, a mistake, The code "if (likely(!last_byte))" is wrong judgement. > >> e.g. addr=0, so last_byte = 15 & KASAN_SHADOW_MASK = 7, then the code will >> continue to call "return memory_is_poisoned_1(addr + 15);" >>
Right, put this into changelog please.
>> Thanks, >> Xishi Qiu >>
| |