Messages in this thread Patch in this message | | | From | Andrey Konovalov <> | Subject | [PATCH v3 2/3] kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY | Date | Thu, 3 Jan 2019 19:45:20 +0100 |
| |
With CONFIG_HARDENED_USERCOPY enabled __check_heap_object() compares and then subtracts a potentially tagged pointer with a non-tagged address of the page that this pointer belongs to, which leads to unexpected behavior.
Untag the pointer in __check_heap_object() before doing any of these operations.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- mm/slub.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/mm/slub.c b/mm/slub.c index 36c0befeebd8..1e3d0ec4e200 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -3846,6 +3846,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page, unsigned int offset; size_t object_size; + ptr = kasan_reset_tag(ptr); + /* Find object and usable object size. */ s = page->slab_cache; -- 2.20.1.415.g653613c723-goog
| |