diff options
| author | Andrey Konovalov <andreyknvl@google.com> | 2023-11-20 18:47:17 +0100 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2023-12-11 01:51:47 +0100 |
| commit | 7d88e4f768b0fdb85b68f0e4679bb10fdb05c808 (patch) | |
| tree | 743bc32fa44592a80b330786afec4f764b8dd434 /mm/kasan | |
| parent | kasan: remove atomic accesses to stack ring entries (diff) | |
| download | linux-7d88e4f768b0fdb85b68f0e4679bb10fdb05c808.tar.xz linux-7d88e4f768b0fdb85b68f0e4679bb10fdb05c808.zip | |
kasan: check object_size in kasan_complete_mode_report_info
Check the object size when looking up entries in the stack ring.
If the size of the object for which a report is being printed does not
match the size of the object for which a stack trace has been saved in the
stack ring, the saved stack trace is irrelevant.
Link: https://lkml.kernel.org/r/68c6948175aadd7e7e7deea61725103d64a4528f.1700502145.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'mm/kasan')
| -rw-r--r-- | mm/kasan/report_tags.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/mm/kasan/report_tags.c b/mm/kasan/report_tags.c index 78abdcde5da9..55154743f915 100644 --- a/mm/kasan/report_tags.c +++ b/mm/kasan/report_tags.c @@ -7,6 +7,7 @@ #include <linux/atomic.h> #include "kasan.h" +#include "../slab.h" extern struct kasan_stack_ring stack_ring; @@ -58,7 +59,8 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) entry = &stack_ring.entries[i % stack_ring.size]; if (kasan_reset_tag(entry->ptr) != info->object || - get_tag(entry->ptr) != get_tag(info->access_addr)) + get_tag(entry->ptr) != get_tag(info->access_addr) || + info->cache->object_size != entry->size) continue; if (entry->is_free) { |