Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi...

[cascardo/linux.git] / mm / kasan / kasan.c

diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index b6f99e8..88af13c 100644 (file)
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -442,11 +442,6 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object)
        kasan_poison_shadow(object,
                        round_up(cache->object_size, KASAN_SHADOW_SCALE_SIZE),
                        KASAN_KMALLOC_REDZONE);
-       if (cache->flags & SLAB_KASAN) {
-               struct kasan_alloc_meta *alloc_info =
-                       get_alloc_info(cache, object);
-               alloc_info->state = KASAN_STATE_INIT;
-       }
 }
 
 static inline int in_irqentry_text(unsigned long ptr)
@@ -510,6 +505,17 @@ struct kasan_free_meta *get_free_info(struct kmem_cache *cache,
        return (void *)object + cache->kasan_info.free_meta_offset;
 }
 
+void kasan_init_slab_obj(struct kmem_cache *cache, const void *object)
+{
+       struct kasan_alloc_meta *alloc_info;
+
+       if (!(cache->flags & SLAB_KASAN))
+               return;
+
+       alloc_info = get_alloc_info(cache, object);
+       __memset(alloc_info, 0, sizeof(*alloc_info));
+}
+
 void kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags)
 {
        kasan_kmalloc(cache, object, cache->object_size, flags);
@@ -529,34 +535,26 @@ static void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
 
 bool kasan_slab_free(struct kmem_cache *cache, void *object)
 {
+       s8 shadow_byte;
+
        /* RCU slabs could be legally used after free within the RCU period */
        if (unlikely(cache->flags & SLAB_DESTROY_BY_RCU))
                return false;
 
-       if (likely(cache->flags & SLAB_KASAN)) {
-               struct kasan_alloc_meta *alloc_info;
-               struct kasan_free_meta *free_info;
+       shadow_byte = READ_ONCE(*(s8 *)kasan_mem_to_shadow(object));
+       if (shadow_byte < 0 || shadow_byte >= KASAN_SHADOW_SCALE_SIZE) {
+               kasan_report_double_free(cache, object, shadow_byte);
+               return true;
+       }
 
-               alloc_info = get_alloc_info(cache, object);
-               free_info = get_free_info(cache, object);
+       kasan_poison_slab_free(cache, object);
 
-               switch (alloc_info->state) {
-               case KASAN_STATE_ALLOC:
-                       alloc_info->state = KASAN_STATE_QUARANTINE;
-                       quarantine_put(free_info, cache);
-                       set_track(&free_info->track, GFP_NOWAIT);
-                       kasan_poison_slab_free(cache, object);
-                       return true;
-               case KASAN_STATE_QUARANTINE:
-               case KASAN_STATE_FREE:
-                       pr_err("Double free");
-                       dump_stack();
-                       break;
-               default:
-                       break;
-               }
-       }
-       return false;
+       if (unlikely(!(cache->flags & SLAB_KASAN)))
+               return false;
+
+       set_track(&get_alloc_info(cache, object)->free_track, GFP_NOWAIT);
+       quarantine_put(get_free_info(cache, object), cache);
+       return true;
 }
 
 void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
@@ -565,7 +563,7 @@ void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
        unsigned long redzone_start;
        unsigned long redzone_end;
 
-       if (flags & __GFP_RECLAIM)
+       if (gfpflags_allow_blocking(flags))
                quarantine_reduce();
 
        if (unlikely(object == NULL))
@@ -579,14 +577,9 @@ void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
        kasan_unpoison_shadow(object, size);
        kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
                KASAN_KMALLOC_REDZONE);
-       if (cache->flags & SLAB_KASAN) {
-               struct kasan_alloc_meta *alloc_info =
-                       get_alloc_info(cache, object);
 
-               alloc_info->state = KASAN_STATE_ALLOC;
-               alloc_info->alloc_size = size;
-               set_track(&alloc_info->track, flags);
-       }
+       if (cache->flags & SLAB_KASAN)
+               set_track(&get_alloc_info(cache, object)->alloc_track, flags);
 }
 EXPORT_SYMBOL(kasan_kmalloc);
 
@@ -596,7 +589,7 @@ void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags)
        unsigned long redzone_start;
        unsigned long redzone_end;
 
-       if (flags & __GFP_RECLAIM)
+       if (gfpflags_allow_blocking(flags))
                quarantine_reduce();
 
        if (unlikely(ptr == NULL))