Re: [PATCH] mm, mempool: kasan: poison mempool elements

[Andrew Morton <akpm@linux-foundation.org>]

On Fri, 03 Apr 2015 17:47:47 +0300 Andrey Ryabinin <a.ryabinin@samsung.com> wrote:

> Mempools keep allocated objects in reserved for situations
> when ordinary allocation may not be possible to satisfy.
> These objects shouldn't be accessed before they leave
> the pool.
> This patch poison elements when get into the pool
> and unpoison when they leave it. This will let KASan
> to detect use-after-free of mempool's elements.
> 
> ...
>
> +static void kasan_poison_element(mempool_t *pool, void *element)
> +{
> +	if (pool->alloc == mempool_alloc_slab)
> +		kasan_slab_free(pool->pool_data, element);
> +	if (pool->alloc == mempool_kmalloc)
> +		kasan_kfree(element);
> +	if (pool->alloc == mempool_alloc_pages)
> +		kasan_free_pages(element, (unsigned long)pool->pool_data);
> +}

We recently discovered that mempool pages (from alloc_pages, not slab)
can be in highmem.  But kasan apepars to handle highmem pages (by
baling out) so we should be OK with that.

Can kasan be taught to use kmap_atomic() or is it more complicated than
that?  It probably isn't worthwhile - highmem pages don'[t get used by the
kernel much and most bugs will be found using 64-bit testing anyway.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>