iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/mm
History
Andrey Konovalov 26a5ca7a73 kasan, mm: fail krealloc on freed objects 
Currently, if krealloc() is called on a freed object with KASAN enabled,
it allocates and returns a new object, but doesn't copy any memory from
the old one as ksize() returns 0.  This makes the caller believe that
krealloc() succeeded (KASAN report is printed though).

This patch adds an accessibility check into __do_krealloc().  If the check
fails, krealloc() returns NULL.  This check duplicates the one in ksize();
this is fixed in the following patch.

This patch also adds a KASAN-KUnit test to check krealloc() behaviour when
it's called on a freed object.

Link: https://lkml.kernel.org/r/cbcf7b02be0a1ca11de4f833f2ff0b3f2c9b00c8.1612546384.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-02-26 09:41:03 -08:00
..
kasan
kasan: unify large kfree checks
2021-02-26 09:41:03 -08:00
kfence
kfence: use error_report_end tracepoint
2021-02-26 09:41:02 -08:00
backing-dev.c
mm/backing-dev.c: use might_alloc()
2021-02-26 09:41:01 -08:00
balloon_compaction.c
mm/balloon_compaction: suppress allocation warnings
2019-09-04 07:42:01 -04:00
cleancache.c
Driver Core and debugfs changes for 5.3-rc1
2019-07-12 12:24:03 -07:00
cma_debug.c
debugfs: make sure we can remove u32_array files cleanly
2020-07-10 13:54:00 -07:00
cma.c
mm: cma: print region name on failure
2021-02-26 09:41:00 -08:00
cma.h
mm: cma: use CMA_MAX_NAME to define the length of cma name array
2020-09-01 09:19:43 +02:00
compaction.c
mm, compaction: make fast_isolate_freepages() stay within zone
2021-02-24 13:38:34 -08:00
debug_page_ref.c
…
debug_vm_pgtable.c
mm/debug_vm_pgtable/basic: iterate over entire protection_map[]
2021-02-24 13:38:27 -08:00
debug.c
mm/debug: improve memcg debugging
2021-02-24 13:38:27 -08:00
dmapool.c
mm/dmapool: use might_alloc()
2021-02-26 09:41:01 -08:00
early_ioremap.c
mm/early_ioremap.c: use __func__ instead of function name
2021-02-26 09:41:02 -08:00
fadvise.c
mm, fadvise: improve the expensive remote LRU cache draining after FADV_DONTNEED
2020-10-13 18:38:29 -07:00
failslab.c
mm/failslab.c: by default, do not fail allocations with direct reclaim only
2019-07-12 11:05:43 -07:00
filemap.c
mm: pass pvec directly to find_get_entries
2021-02-26 09:40:59 -08:00
frontswap.c
mm/frontswap: mark various intentional data races
2020-08-14 19:56:56 -07:00
gup_test.c
mm/gup_test.c: mark gup_test_init as __init function
2020-12-15 12:13:38 -08:00
gup_test.h
selftests/vm: gup_test: introduce the dump_pages() sub-test
2020-12-15 12:13:38 -08:00
gup.c
mm/hugetlb: grab head page refcount once for group of subpages
2021-02-24 13:38:32 -08:00
highmem.c
mm/highmem: prepare for overriding set_pte_at()
2021-01-24 10:34:52 -08:00
hmm.c
mm: do page fault accounting in handle_mm_fault
2020-08-12 10:58:02 -07:00
huge_memory.c
mm,thp,shmem: limit shmem THP alloc gfp_mask
2021-02-26 09:40:59 -08:00
hugetlb_cgroup.c
hugetlb_cgroup: use helper pages_per_huge_page() in hugetlb_cgroup
2021-02-24 13:38:33 -08:00
hugetlb.c
mm/hugetlb: change hugetlb_reserve_pages() to type bool
2021-02-24 13:38:35 -08:00
hwpoison-inject.c
mm,hwpoison-inject: don't pin for hwpoison_filter
2020-10-16 11:11:16 -07:00
init-mm.c
mm/gup: prevent gup_fast from racing with COW during fork
2020-12-15 12:13:39 -08:00
internal.h
mm: add and use find_lock_entries
2021-02-26 09:40:59 -08:00
interval_tree.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 248
2019-06-19 17:09:08 +02:00
ioremap.c
mm: move p?d_alloc_track to separate header file
2020-08-07 11:33:26 -07:00
Kconfig
media: videobuf2: Move frame_vector into media subsystem
2021-01-12 14:15:31 +01:00
Kconfig.debug
mm, page_poison: remove CONFIG_PAGE_POISONING_ZERO
2020-12-15 12:13:46 -08:00
khugepaged.c
mm,thp,shmem: make khugepaged obey tmpfs mount flags
2021-02-26 09:40:59 -08:00
kmemleak.c
mm/kmemleak: rely on rcu for task stack scanning
2020-10-13 18:38:27 -07:00
ksm.c
mm: cleanup kstrto*() usage
2020-12-15 12:13:47 -08:00
list_lru.c
mm/list_lru.c: remove kvfree_rcu_local()
2021-02-24 13:38:30 -08:00
maccess.c
uaccess: add force_uaccess_{begin,end} helpers
2020-08-12 10:57:59 -07:00
madvise.c
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
Makefile
mm: add Kernel Electric-Fence infrastructure
2021-02-26 09:41:02 -08:00
mapping_dirty_helpers.c
mm/mapping_dirty_helpers: enhance the kernel-doc markups
2020-12-15 12:13:41 -08:00
memblock.c
memblock: remove return value of memblock_free_all()
2021-02-22 13:01:23 -08:00
memcontrol.c
mm: memcontrol: fix get_active_memcg return value
2021-02-24 13:38:30 -08:00
memfd.c
mm: page cache: store only head pages in i_pages
2019-09-24 15:54:08 -07:00
memory_hotplug.c
mm/memory_hotplug: prevalidate the address range being added with platform
2021-02-26 09:41:00 -08:00
memory-failure.c
mm: fix memory_failure() handling of dax-namespace metadata
2021-02-26 09:41:00 -08:00
memory.c
hugetlb: fix copy_huge_page_from_user contig page struct assumption
2021-02-24 13:38:33 -08:00
mempolicy.c
mm/mempolicy: use helper range_in_vma() in queue_pages_test_walk()
2021-02-24 13:38:34 -08:00
mempool.c
kasan: move _RET_IP_ to inline wrappers
2021-02-24 13:38:31 -08:00
memremap.c
mm/memory_hotplug: prevalidate the address range being added with platform
2021-02-26 09:41:00 -08:00
memtest.c
…
migrate.c
mm: memcg: add swapcache stat for memcg v2
2021-02-24 13:38:29 -08:00
mincore.c
inode: make init and permission helpers idmapped mount aware
2021-01-24 14:27:16 +01:00
mlock.c
mm/mlock: stop counting mlocked pages when none vma is found
2021-02-26 09:41:01 -08:00
mm_init.c
mm: fix fall-through warnings for Clang
2020-12-15 12:13:47 -08:00
mmap_lock.c
mm: mmap_lock: add tracepoints around lock acquisition
2020-12-15 12:13:41 -08:00
mmap.c
mm/mmap.c: remove unnecessary local variable
2021-02-24 13:38:30 -08:00
mmu_gather.c
tlb: mmu_gather: Remove start/end arguments from tlb_gather_mmu()
2021-01-29 20:02:29 +01:00
mmu_notifier.c
mm: track mmu notifiers in fs_reclaim_acquire/release
2020-12-15 12:13:41 -08:00
mmzone.c
mm/lru: replace pgdat lru_lock with lruvec lock
2020-12-15 14:48:04 -08:00
mprotect.c
mm/mprotect.c: optimize error detection in do_mprotect_pkey()
2021-02-24 13:38:30 -08:00
mremap.c
mm: mremap: unlink anon_vmas when mremap with MREMAP_DONTUNMAP success
2021-02-24 13:38:30 -08:00
msync.c
mmap locking API: use coccinelle to convert mmap_sem rwsem call sites
2020-06-09 09:39:14 -07:00
nommu.c
mm/nommu: Fix return type of filemap_map_pages()
2021-01-28 14:10:31 +00:00
oom_kill.c
mm, oom: fix a comment in dump_task()
2021-02-24 13:38:34 -08:00
page_alloc.c
mm/page_alloc: count CMA pages per zone and print them in /proc/zoneinfo
2021-02-26 09:41:00 -08:00
page_counter.c
mm/page_counter: use page_counter_read in page_counter_set_max
2020-12-15 12:13:40 -08:00
page_ext.c
mm: fix some spelling mistakes in comments
2020-12-15 22:46:19 -08:00
page_idle.c
mm: page_idle_get_page() does not need lru_lock
2020-12-15 14:48:03 -08:00
page_io.c
mm/page_io: use pr_alert_ratelimited for swap read/write errors
2021-02-24 13:38:29 -08:00
page_isolation.c
mm/page_isolation: do not isolate the max order page
2020-12-15 12:13:45 -08:00
page_owner.c
mm/page_owner: use helper function zone_end_pfn() to get end_pfn
2021-02-24 13:38:27 -08:00
page_poison.c
kasan, mm: reset tags when accessing metadata
2020-12-22 12:55:08 -08:00
page_reporting.c
mm/page_reporting: use list_entry_is_head() in page_reporting_cycle()
2021-02-24 13:38:30 -08:00
page_reporting.h
mm: introduce include/linux/pgtable.h
2020-06-09 09:39:13 -07:00
page_vma_mapped.c
mm/page_vma_mapped.c: add colon to fix kernel-doc markups error for check_pte
2020-12-15 12:13:41 -08:00
page-writeback.c
mm: make wait_on_page_writeback() wait for multiple pending writebacks
2021-01-05 11:33:00 -08:00
pagewalk.c
mmap locking API: convert mmap_sem comments
2020-06-09 09:39:14 -07:00
percpu-internal.h
mm: memcg/percpu: account percpu memory to memory cgroups
2020-08-12 10:57:55 -07:00
percpu-km.c
mm: memcg/percpu: account percpu memory to memory cgroups
2020-08-12 10:57:55 -07:00
percpu-stats.c
mm: memcg/percpu: account percpu memory to memory cgroups
2020-08-12 10:57:55 -07:00
percpu-vm.c
mm: memcg/percpu: account percpu memory to memory cgroups
2020-08-12 10:57:55 -07:00
percpu.c
percpu: fix clang modpost section mismatch
2021-02-14 18:15:15 +00:00
pgalloc-track.h
mm: move p?d_alloc_track to separate header file
2020-08-07 11:33:26 -07:00
pgtable-generic.c
mm/pgtable-generic.c: optimize the VM_BUG_ON condition in pmdp_huge_clear_flush()
2021-02-24 13:38:30 -08:00
process_vm_access.c
mm/process_vm_access.c: include compat.h
2021-01-12 18:12:54 -08:00
ptdump.c
kasan, arm64: expand CONFIG_KASAN checks
2020-12-22 12:55:08 -08:00
readahead.c
mm: use limited read-ahead to satisfy read
2020-10-17 13:49:08 -06:00
rmap.c
mm/rmap: correct obsolete comment of page_get_anon_vma()
2021-02-26 09:41:01 -08:00
rodata_test.c
mm/rodata_test.c: fix missing function declaration
2020-08-21 09:52:53 -07:00
shmem.c
mm,shmem,thp: limit shmem THP allocations to requested zones
2021-02-26 09:40:59 -08:00
shuffle.c
mm: rename page_order() to buddy_order()
2020-10-16 11:11:19 -07:00
shuffle.h
mm/shuffle: remove dynamic reconfiguration
2020-08-07 11:33:29 -07:00
slab_common.c
kasan, mm: fail krealloc on freed objects
2021-02-26 09:41:03 -08:00
slab.c
mm, kfence: insert KFENCE hooks for SLAB
2021-02-26 09:41:02 -08:00
slab.h
mm: memcg/slab: pre-allocate obj_cgroups for slab caches with SLAB_ACCOUNT
2021-02-24 13:38:29 -08:00
slob.c
mm, tracing: record slab name for kmem_cache_free()
2021-02-24 13:38:26 -08:00
slub.c
kasan, mm: optimize kmalloc poisoning
2021-02-26 09:41:02 -08:00
sparse-vmemmap.c
mm/sparse: only sub-section aligned range would be populated
2020-08-07 11:33:27 -07:00
sparse.c
mm/memory_hotplug: guard more declarations by CONFIG_MEMORY_HOTPLUG
2020-10-16 11:11:18 -07:00
swap_cgroup.c
mm: memcontrol: make swap tracking an integral part of memory control
2020-06-03 20:09:48 -07:00
swap_slots.c
mm/swap_slots.c: remove redundant NULL check
2021-02-24 13:38:28 -08:00
swap_state.c
mm: add FGP_ENTRY
2021-02-26 09:40:59 -08:00
swap.c
mm: remove pagevec_lookup_entries
2021-02-26 09:40:59 -08:00
swapfile.c
mm/swapfile.c: fix debugging information problem
2021-02-24 13:38:28 -08:00
truncate.c
mm: remove pagevec_lookup_entries
2021-02-26 09:40:59 -08:00
usercopy.c
mm/usercopy.c: delete duplicated word
2020-08-12 10:57:58 -07:00
userfaultfd.c
mm/vmscan: protect the workingset on anonymous LRU
2020-08-12 10:57:55 -07:00
util.c
mm: Make mem_dump_obj() handle vmalloc() memory
2021-01-22 15:24:04 -08:00
vmacache.c
kernel: better document the use_mm/unuse_mm API contract
2020-06-10 19:14:18 -07:00
vmalloc.c
Merge branch 'for-mingo-rcu' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu
2021-02-12 12:56:55 +01:00
vmpressure.c
mm: vmpressure: use mem_cgroup_is_root API
2020-04-02 09:35:31 -07:00
vmscan.c
mm/vmscan: restore zone_reclaim_mode ABI
2021-02-24 13:38:34 -08:00
vmstat.c
mm/vmstat.c: erase latency in vmstat_shepherd
2021-02-26 09:41:00 -08:00
workingset.c
mm: workingset: clarify eviction order and distance calculation
2021-02-24 13:38:34 -08:00
z3fold.c
mm: set the sleep_mapped to true for zbud and z3fold
2021-02-26 09:41:01 -08:00
zbud.c
mm: set the sleep_mapped to true for zbud and z3fold
2021-02-26 09:41:01 -08:00
zpool.c
mm/zswap: add the flag can_sleep_mapped
2021-02-26 09:41:01 -08:00
zsmalloc.c
mm/zsmalloc.c: use page_private() to access page->private
2021-02-26 09:41:01 -08:00
zswap.c
mm/zswap: add the flag can_sleep_mapped
2021-02-26 09:41:01 -08:00