diff options
| author | Vlastimil Babka <vbabka@suse.cz> | 2022-11-11 09:08:18 +0100 |
|---|---|---|
| committer | Vlastimil Babka <vbabka@suse.cz> | 2022-11-21 10:36:09 +0100 |
| commit | 90e9b23a60d5b4c8317f58e01ed05d3bdf063440 (patch) | |
| tree | b87f0bd1d2c0ab251fafcbc4aebd5e3c73799397 /mm/slab.c | |
| parent | 76537db3b95cbf5d0189ce185c16db9f93017021 (diff) | |
| parent | 946fa0dbf2d8923a587f7348adf16563d59f1b3d (diff) | |
Merge branch 'slab/for-6.2/kmalloc_redzone' into slab/for-next
kmalloc() redzone improvements by Feng Tang
From cover letter [1]:
kmalloc's API family is critical for mm, and one of its nature is that
it will round up the request size to a fixed one (mostly power of 2).
When user requests memory for '2^n + 1' bytes, actually 2^(n+1) bytes
could be allocated, so there is an extra space than what is originally
requested.
This patchset tries to extend the redzone sanity check to the extra
kmalloced buffer than requested, to better detect un-legitimate access
to it. (depends on SLAB_STORE_USER & SLAB_RED_ZONE)
[1] https://lore.kernel.org/all/20221021032405.1825078-1-feng.tang@intel.com/
Diffstat (limited to 'mm/slab.c')
| -rw-r--r-- | mm/slab.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/mm/slab.c b/mm/slab.c index cbee5bbc6f11..7a269db050ee 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -3258,7 +3258,8 @@ slab_alloc_node(struct kmem_cache *cachep, struct list_lru *lru, gfp_t flags, init = slab_want_init_on_alloc(flags, cachep); out: - slab_post_alloc_hook(cachep, objcg, flags, 1, &objp, init); + slab_post_alloc_hook(cachep, objcg, flags, 1, &objp, init, + cachep->object_size); return objp; } @@ -3501,13 +3502,13 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size, * Done outside of the IRQ disabled section. */ slab_post_alloc_hook(s, objcg, flags, size, p, - slab_want_init_on_alloc(flags, s)); + slab_want_init_on_alloc(flags, s), s->object_size); /* FIXME: Trace call missing. Christoph would like a bulk variant */ return size; error: local_irq_enable(); cache_alloc_debugcheck_after_bulk(s, flags, i, p, _RET_IP_); - slab_post_alloc_hook(s, objcg, flags, i, p, false); + slab_post_alloc_hook(s, objcg, flags, i, p, false, s->object_size); kmem_cache_free_bulk(s, i, p); return 0; } |