From: Andrey Konovalov andreyknvl@google.com
[ Upstream commit 219667c23c68eb3dbc0d5662b9246f28477fe529 ]
Similarly to commit 96fedce27e13 ("kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY"), we need to reset pointer tags in __check_heap_object() in mm/slab.c before doing any pointer math.
Link: http://lkml.kernel.org/r/9a5c0f958db10e69df5ff9f2b997866b56b7effc.1550602886... Signed-off-by: Andrey Konovalov andreyknvl@google.com Tested-by: Qian Cai cai@lca.pw Cc: Alexander Potapenko glider@google.com Cc: Andrey Ryabinin aryabinin@virtuozzo.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Dmitry Vyukov dvyukov@google.com Cc: Evgeniy Stepanov eugenis@google.com Cc: Kostya Serebryany kcc@google.com Cc: Vincenzo Frascino vincenzo.frascino@arm.com Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Linus Torvalds torvalds@linux-foundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- mm/slab.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/mm/slab.c b/mm/slab.c index 9d5de959d9d9..05f21f736be8 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -4421,6 +4421,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page, unsigned int objnr; unsigned long offset;
+ ptr = kasan_reset_tag(ptr); + /* Find and validate object. */ cachep = page->slab_cache; objnr = obj_to_index(cachep, page, (void *)ptr);