From cbf4ef908647bd29b484455366fba96bbc1a1088 Mon Sep 17 00:00:00 2001 From: Andrey Konovalov Date: Tue, 8 Jan 2019 15:23:15 -0800 Subject: [PATCH] UPSTREAM: kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY Upstream commit 96fedce27e1356a2fff1c270710d9405848db562. With CONFIG_HARDENED_USERCOPY enabled __check_heap_object() compares and then subtracts a potentially tagged pointer with a non-tagged address of the page that this pointer belongs to, which leads to unexpected behavior. Untag the pointer in __check_heap_object() before doing any of these operations. Link: http://lkml.kernel.org/r/7e756a298d514c4482f52aea6151db34818d395d.1546540962.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Vincenzo Frascino Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Andrey Konovalov Change-Id: I4730bbf1b500a8a59b64e57325965c8affb625e7 Bug: 128674696 --- mm/slub.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/slub.c b/mm/slub.c index 7a1dfade5903..c66478e76a99 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -3848,6 +3848,8 @@ const char *__check_heap_object(const void *ptr, unsigned long n, unsigned long offset; size_t object_size; + ptr = kasan_reset_tag(ptr); + /* Find object and usable object size. */ s = page->slab_cache; object_size = slab_ksize(s);