From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2EB2CC4345F for ; Tue, 30 Apr 2024 10:43:19 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 748B56B007B; Tue, 30 Apr 2024 06:43:18 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6F8606B0083; Tue, 30 Apr 2024 06:43:18 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 572876B0085; Tue, 30 Apr 2024 06:43:18 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 37F3F6B007B for ; Tue, 30 Apr 2024 06:43:18 -0400 (EDT) Received: from smtpin05.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id E7542140406 for ; Tue, 30 Apr 2024 10:43:17 +0000 (UTC) X-FDA: 82065861234.05.F1175A1 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.223.130]) by imf01.hostedemail.com (Postfix) with ESMTP id 807D540004 for ; Tue, 30 Apr 2024 10:43:15 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=xzEAnfTo; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=kSKQatFD; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=xzEAnfTo; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=kSKQatFD; spf=pass (imf01.hostedemail.com: domain of vbabka@suse.cz designates 195.135.223.130 as permitted sender) smtp.mailfrom=vbabka@suse.cz; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1714473795; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=q2vh/LgyoryZMtDmdwQOlvo/2zwHjg66AAKLxPaT11k=; b=hsVTuqLTn4J7VNlIqh6HMFc+os48BoHEb6NnP5WM6bLEdU4SOiJQ6fYizI1fwV3TrhHwZK hwCTewDS+i5et3iKwpgPy8hCFLEW5e2qk8MaZgJNKn9IB2bu5jvTGbIAXP41nwIwpv4J0G H7vjbkLnNHSCkHeSk6Cn9XdNZw0+tM0= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=xzEAnfTo; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=kSKQatFD; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=xzEAnfTo; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=kSKQatFD; spf=pass (imf01.hostedemail.com: domain of vbabka@suse.cz designates 195.135.223.130 as permitted sender) smtp.mailfrom=vbabka@suse.cz; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1714473795; a=rsa-sha256; cv=none; b=eQduV6Ekp9H/SzpfrseGVhioQhx9JFct5iGzADm3lb9lvk3W760TP2za7dn2i1LeS+b5uf oEHTbmZVvW3vt2sJJMWhrjzdiP7tU7+ngRLReUOYBkLgUp5FSgWLlRnZ1mr0E8/49CZL1c 9D3sZKV/th6Qmsmt8u2rcJ8taj7pT/I= Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [10.150.64.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id C9B2B33F8C; Tue, 30 Apr 2024 10:43:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1714473793; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=q2vh/LgyoryZMtDmdwQOlvo/2zwHjg66AAKLxPaT11k=; b=xzEAnfTo3jNNiEnVC1REdOpadoTJFcvjX60Os6xUQXuBYyFCGicV3unEhp42AgBfyAe+z2 /w+SFcHMgyZA2vRz4iNk/rvhOMBQMYuJi5O+RgWkP1PUEFO427VMoG1oGoJv9PdSy708px J2Rv2iASJIf0kmOX1bEQoJgjuAoeNs0= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1714473793; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=q2vh/LgyoryZMtDmdwQOlvo/2zwHjg66AAKLxPaT11k=; b=kSKQatFDCfX2QUIjVbyOQ+BA8llcTcBtfIu2UGxl+x2IYE5dlS6bF+NIUza5CU3mqVARUd RuqCDEBU0BWWB2BQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1714473793; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=q2vh/LgyoryZMtDmdwQOlvo/2zwHjg66AAKLxPaT11k=; b=xzEAnfTo3jNNiEnVC1REdOpadoTJFcvjX60Os6xUQXuBYyFCGicV3unEhp42AgBfyAe+z2 /w+SFcHMgyZA2vRz4iNk/rvhOMBQMYuJi5O+RgWkP1PUEFO427VMoG1oGoJv9PdSy708px J2Rv2iASJIf0kmOX1bEQoJgjuAoeNs0= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1714473793; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=q2vh/LgyoryZMtDmdwQOlvo/2zwHjg66AAKLxPaT11k=; b=kSKQatFDCfX2QUIjVbyOQ+BA8llcTcBtfIu2UGxl+x2IYE5dlS6bF+NIUza5CU3mqVARUd RuqCDEBU0BWWB2BQ== Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id B1D09136A8; Tue, 30 Apr 2024 10:43:13 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id obj9KkHLMGZ2eAAAD6G6ig (envelope-from ); Tue, 30 Apr 2024 10:43:13 +0000 Message-ID: <434c6262-3428-46a4-995b-925987d4d389@suse.cz> Date: Tue, 30 Apr 2024 12:43:13 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] slub: Fixes freepointer encoding for single free Content-Language: en-US To: Nicolas Bouchinet , linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Chengming Zhou , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com> References: From: Vlastimil Babka Autocrypt: addr=vbabka@suse.cz; keydata= xsFNBFZdmxYBEADsw/SiUSjB0dM+vSh95UkgcHjzEVBlby/Fg+g42O7LAEkCYXi/vvq31JTB KxRWDHX0R2tgpFDXHnzZcQywawu8eSq0LxzxFNYMvtB7sV1pxYwej2qx9B75qW2plBs+7+YB 87tMFA+u+L4Z5xAzIimfLD5EKC56kJ1CsXlM8S/LHcmdD9Ctkn3trYDNnat0eoAcfPIP2OZ+ 9oe9IF/R28zmh0ifLXyJQQz5ofdj4bPf8ecEW0rhcqHfTD8k4yK0xxt3xW+6Exqp9n9bydiy tcSAw/TahjW6yrA+6JhSBv1v2tIm+itQc073zjSX8OFL51qQVzRFr7H2UQG33lw2QrvHRXqD Ot7ViKam7v0Ho9wEWiQOOZlHItOOXFphWb2yq3nzrKe45oWoSgkxKb97MVsQ+q2SYjJRBBH4 8qKhphADYxkIP6yut/eaj9ImvRUZZRi0DTc8xfnvHGTjKbJzC2xpFcY0DQbZzuwsIZ8OPJCc LM4S7mT25NE5kUTG/TKQCk922vRdGVMoLA7dIQrgXnRXtyT61sg8PG4wcfOnuWf8577aXP1x 6mzw3/jh3F+oSBHb/GcLC7mvWreJifUL2gEdssGfXhGWBo6zLS3qhgtwjay0Jl+kza1lo+Cv BB2T79D4WGdDuVa4eOrQ02TxqGN7G0Biz5ZLRSFzQSQwLn8fbwARAQABzSBWbGFzdGltaWwg QmFia2EgPHZiYWJrYUBzdXNlLmN6PsLBlAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIe AQIXgBYhBKlA1DSZLC6OmRA9UCJPp+fMgqZkBQJkBREIBQkRadznAAoJECJPp+fMgqZkNxIQ ALZRqwdUGzqL2aeSavbum/VF/+td+nZfuH0xeWiO2w8mG0+nPd5j9ujYeHcUP1edE7uQrjOC Gs9sm8+W1xYnbClMJTsXiAV88D2btFUdU1mCXURAL9wWZ8Jsmz5ZH2V6AUszvNezsS/VIT87 AmTtj31TLDGwdxaZTSYLwAOOOtyqafOEq+gJB30RxTRE3h3G1zpO7OM9K6ysLdAlwAGYWgJJ V4JqGsQ/lyEtxxFpUCjb5Pztp7cQxhlkil0oBYHkudiG8j1U3DG8iC6rnB4yJaLphKx57NuQ PIY0Bccg+r9gIQ4XeSK2PQhdXdy3UWBr913ZQ9AI2usid3s5vabo4iBvpJNFLgUmxFnr73SJ KsRh/2OBsg1XXF/wRQGBO9vRuJUAbnaIVcmGOUogdBVS9Sun/Sy4GNA++KtFZK95U7J417/J Hub2xV6Ehc7UGW6fIvIQmzJ3zaTEfuriU1P8ayfddrAgZb25JnOW7L1zdYL8rXiezOyYZ8Fm ZyXjzWdO0RpxcUEp6GsJr11Bc4F3aae9OZtwtLL/jxc7y6pUugB00PodgnQ6CMcfR/HjXlae h2VS3zl9+tQWHu6s1R58t5BuMS2FNA58wU/IazImc/ZQA+slDBfhRDGYlExjg19UXWe/gMcl De3P1kxYPgZdGE2eZpRLIbt+rYnqQKy8UxlszsBNBFsZNTUBCACfQfpSsWJZyi+SHoRdVyX5 J6rI7okc4+b571a7RXD5UhS9dlVRVVAtrU9ANSLqPTQKGVxHrqD39XSw8hxK61pw8p90pg4G /N3iuWEvyt+t0SxDDkClnGsDyRhlUyEWYFEoBrrCizbmahOUwqkJbNMfzj5Y7n7OIJOxNRkB IBOjPdF26dMP69BwePQao1M8Acrrex9sAHYjQGyVmReRjVEtv9iG4DoTsnIR3amKVk6si4Ea X/mrapJqSCcBUVYUFH8M7bsm4CSxier5ofy8jTEa/CfvkqpKThTMCQPNZKY7hke5qEq1CBk2 wxhX48ZrJEFf1v3NuV3OimgsF2odzieNABEBAAHCwXwEGAEKACYCGwwWIQSpQNQ0mSwujpkQ PVAiT6fnzIKmZAUCZAUSmwUJDK5EZgAKCRAiT6fnzIKmZOJGEACOKABgo9wJXsbWhGWYO7mD 8R8mUyJHqbvaz+yTLnvRwfe/VwafFfDMx5GYVYzMY9TWpA8psFTKTUIIQmx2scYsRBUwm5VI EurRWKqENcDRjyo+ol59j0FViYysjQQeobXBDDE31t5SBg++veI6tXfpco/UiKEsDswL1WAr tEAZaruo7254TyH+gydURl2wJuzo/aZ7Y7PpqaODbYv727Dvm5eX64HCyyAH0s6sOCyGF5/p eIhrOn24oBf67KtdAN3H9JoFNUVTYJc1VJU3R1JtVdgwEdr+NEciEfYl0O19VpLE/PZxP4wX PWnhf5WjdoNI1Xec+RcJ5p/pSel0jnvBX8L2cmniYnmI883NhtGZsEWj++wyKiS4NranDFlA HdDM3b4lUth1pTtABKQ1YuTvehj7EfoWD3bv9kuGZGPrAeFNiHPdOT7DaXKeHpW9homgtBxj 8aX/UkSvEGJKUEbFL9cVa5tzyialGkSiZJNkWgeHe+jEcfRT6pJZOJidSCdzvJpbdJmm+eED w9XOLH1IIWh7RURU7G1iOfEfmImFeC3cbbS73LQEFGe1urxvIH5K/7vX+FkNcr9ujwWuPE9b 1C2o4i/yZPLXIVy387EjA6GZMqvQUFuSTs/GeBcv0NjIQi8867H3uLjz+mQy63fAitsDwLmR EP+ylKVEKb0Q2A== In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Rspam-User: X-Rspamd-Queue-Id: 807D540004 X-Rspamd-Server: rspam06 X-Stat-Signature: er1ecjtd1c9nguxw4w71xgt48uhidgp5 X-HE-Tag: 1714473795-929447 X-HE-Meta: U2FsdGVkX19HM2jr9G/sVrh5hvPF5Yo/O8VNi9iSNFNB141Zm3AuVSHSF1B804QHdkVXMebm4lfkmDbptsn4/r/uDR6V+aXH8+vFdFVmCUgyNojhgOmfiOkqy/0bMzE+/euwa87vxBxJfTFdAppNtC8VEt8ASS1sPA2S3Vy0CabOGFt4PAOGrtNDWL8ZrOwFaiZxU2eWcBo+/lJHfaoCNYu/Abv2g3o2al87onRQb85VGn6oiFF00fZVe6x0ScqevsPKQ/GZ3ZrYAY4BkoxGwhKvHHlXyCAIqhDaBXkL3t9sn2S29edomIrEzUhdY7/vEN5DXp/NHo4lubklYcfRoFqI+Bb0avjpuVne6quAs8+iAQ1QysfG6DGn78tG9uZUsJBFGY6GbANqfn8avHJrGMol5o3mDTa84G+gQDUMDGkJafJF5TMYpyxHciqXX0EXhzd1y2zQfV8Ww9aLz2lIH9BZwM0mkxu020KE+Vjyy7PcEAGz5WwRsES7pMUHkPsCNv87LgluZ/cRKdQ7z4nTp8FzvZClv7VPMWvjo5QWKX57JnqLlcKLKDwc6/1gVjHeUwv3lslSvQi4fXrmtjdFQsFcbmANLS+P5iiQh4zo0oiNsGW23qWqnZwpu5LQoS+6SDqNjTpiJRabVDjesfWdZ/VZcnMslX7BnJTHmRKBrg+s7CD6ukxnElE6HHaMbYkYoL7yZPCZ9g6KMfZF5LZOBhl6k3MlFRuJSSomj2x7NrdTar+cFjmF61ZqS8wH2afzigkUF2Tr7zFSKSi7ZcgWFpPiOSVZgoVS3IIEVkMOEromqSeBXy/b4aGf7pim/WsZiS95KwZTrw7b2rVK84Hy6dNfEM9ikA3iiMfI1EvbBfOXn0C1WRbAcr4o1SWiUHWaGCDLyQimcwXWiQVvLSqW2/AQ24VHQkSV7kcznR3w8zDEdh0RxscYekUKAVchdUZD8m8KeZZgznBAjkpy2GY Tg7sm6e8 ZDLtmbLi6EThXBiF0DDSZDeeHH3fzyKhYV7AntDiVcLhf76kgq8aMhqrtNAbh60sEA72hbxt4zkiFHEtjFNPM4IpXHWzCBAxHaxIQAK2IrgLbOTN4pMM6jkGHm4l/QdDit/T/sBfWULmBnvJZgFBlTycVU9L9CNin2U91qPMyGtIm3jQRpIwpko9kSohwQ0phzBjRZ8bYt2zUQIDS25cVp1Mv56wzoAz7VgTswPCMQo8JTtXsi9kJ6x1l+SjT4PlaBSk47ShpYDJwqYLTfw0EEY+FBWKmzKNW4gqieMbuxp/PiceWnpSDVZVk5a5meNBCTIS3ApG7oeqQZwRS0xaz4zdAFQDrKZyZ4akd5F2v9cbjmM1+xvAHI8ge7cdO/TOah2jz3KyCt/uZIUELrp7gQ0v+5iVGODGCGNb6BuwaoZC/zswnJQjvW8oRIQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 4/30/24 10:52 AM, Nicolas Bouchinet wrote: > From: Nicolas Bouchinet > > Commit 284f17ac13fe ("mm/slub: handle bulk and single object freeing > separately") splits single and bulk object freeing in two functions > slab_free() and slab_free_bulk() which leads slab_free() to call > slab_free_hook() directly instead of slab_free_freelist_hook(). > > If `init_on_free` is set, slab_free_hook() zeroes the object. > Afterward, if `slub_debug=F` and `CONFIG_SLAB_FREELIST_HARDENED` are > set, the do_slab_free() slowpath executes freelist consistency > checks and try to decode a zeroed freepointer which leads to a > "Freepointer corrupt" detection in check_object(). To make this explanation complete, we should also say that with slab_free_freelist_hook() this doesn't happen as it always sets the freepointer to a valid value after the zeroing. > Object's freepointer thus needs to be avoided when stored outside the > object if init_on_free is set. It would be good to add more reasoning why we're not just doing the same freepointer re-init as slab_free_freelist_hook(), but we decided instead to allow check_object() to actually catch any overwrite by the user of the allocated object, which means it did a buffer overflow. And for that we need to stop wiping or re-initing the outside-object freepointer ourselves... > To reproduce, set `slub_debug=FU init_on_free=1 log_level=7` on the > command line of a kernel build with `CONFIG_SLAB_FREELIST_HARDENED=y`. > > dmesg sample log: > [ 10.708715] ============================================================================= > [ 10.710323] BUG kmalloc-rnd-05-32 (Tainted: G B T ): Freepointer corrupt > [ 10.712695] ----------------------------------------------------------------------------- > [ 10.712695] > [ 10.712695] Slab 0xffffd8bdc400d580 objects=32 used=4 fp=0xffff9d9a80356f80 flags=0x200000000000a00(workingset|slab|node=0|zone=2) > [ 10.716698] Object 0xffff9d9a80356600 @offset=1536 fp=0x7ee4f480ce0ecd7c > [ 10.716698] > [ 10.716698] Bytes b4 ffff9d9a803565f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > [ 10.720703] Object ffff9d9a80356600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > [ 10.720703] Object ffff9d9a80356610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > [ 10.724696] Padding ffff9d9a8035666c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > [ 10.724696] Padding ffff9d9a8035667c: 00 00 00 00 .... > [ 10.724696] FIX kmalloc-rnd-05-32: Object at 0xffff9d9a80356600 not freed > > Co-authored-by: Chengming Zhou So per Documentation/process/submitting-patches.rst the canonical name is Co-developed-by: and Chengming Zhou should respond with his Signed-off-by: > Signed-off-by: Nicolas Bouchinet Otherwise seems correct, thanks! So if you could just resend with updated changelog, would be great. > --- > Changes since v1: > https://lore.kernel.org/all/Zij_fGjRS_rK-65r@archlinux/ > > * Jump above out of object freepointer if init_on_free is set > instead of initializing it with set_freepointer() as suggested > by Vlastimil Babka. > > * Adapt maybe_wipe_obj_freeptr() to avoid wiping out of object > on alloc freepointer as suggested by Chengming Zhou. > > * Reword commit message. > --- > mm/slub.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/mm/slub.c b/mm/slub.c > index 3aa12b9b323d..173c340ec1d3 100644 > --- a/mm/slub.c > +++ b/mm/slub.c > @@ -2102,15 +2102,20 @@ bool slab_free_hook(struct kmem_cache *s, void *x, bool init) > * > * The initialization memset's clear the object and the metadata, > * but don't touch the SLAB redzone. > + * > + * The object's freepointer is also avoided if stored outside the > + * object. > */ > if (unlikely(init)) { > int rsize; > + unsigned int inuse; > > + inuse = get_info_end(s); > if (!kasan_has_integrated_init()) > memset(kasan_reset_tag(x), 0, s->object_size); > rsize = (s->flags & SLAB_RED_ZONE) ? s->red_left_pad : 0; > - memset((char *)kasan_reset_tag(x) + s->inuse, 0, > - s->size - s->inuse - rsize); > + memset((char *)kasan_reset_tag(x) + inuse, 0, > + s->size - inuse - rsize); > } > /* KASAN might put x into memory quarantine, delaying its reuse. */ > return !kasan_slab_free(s, x, init); > @@ -3789,7 +3794,7 @@ static void *__slab_alloc_node(struct kmem_cache *s, > static __always_inline void maybe_wipe_obj_freeptr(struct kmem_cache *s, > void *obj) > { > - if (unlikely(slab_want_init_on_free(s)) && obj) > + if (unlikely(slab_want_init_on_free(s)) && obj && !freeptr_outside_object(s)) > memset((void *)((char *)kasan_reset_tag(obj) + s->offset), > 0, sizeof(void *)); > }