Patch "mm, kasan: account for object redzone in SLUB's nearest_obj()" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

mm, kasan: account for object redzone in SLUB's nearest_obj()

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mm-kasan-account-for-object-redzone-in-slub-s-nearest_obj.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Alexander Potapenko <[email protected]>
Date: Thu, 28 Jul 2016 15:49:04 -0700
Subject: mm, kasan: account for object redzone in SLUB's nearest_obj()

From: Alexander Potapenko <[email protected]>

commit c146a2b98eb5898eb0fab15a332257a4102ecae9 upstream.

When looking up the nearest SLUB object for a given address, correctly calculate its offset if SLAB_RED_ZONE is enabled for that cache.

Previously, when KASAN had detected an error on an object from a cache with SLAB_RED_ZONE set, the actual start address of the object was miscalculated, which led to random stacks having been reported.

When looking up the nearest SLUB object for a given address, correctly calculate its offset if SLAB_RED_ZONE is enabled for that cache.

---
 include/linux/slub_def.h |   10 ++++++----
 mm/slub.c                |    2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

@@ -114,15 +114,17 @@ static inline void sysfs_slab_remove(str
 void object_err(struct kmem_cache *s, struct page *page,
 		u8 *object, char *reason);
 
+void *fixup_red_left(struct kmem_cache *s, void *p);
+
 static inline void *nearest_obj(struct kmem_cache *cache, struct page *page,
 				void *x) {
 	void *object = x - (x - page_address(page)) % cache->size;
 	void *last_object = page_address(page) +
 		(page->objects - 1) * cache->size;
-	if (unlikely(object > last_object))
-		return last_object;
-	else
-		return object;
+	void *result = (unlikely(object > last_object)) ? last_object : object;
+
+	result = fixup_red_left(cache, result);
+	return result;
 }
 
 #endif /* _LINUX_SLUB_DEF_H */

@@ -124,7 +124,7 @@ static inline int kmem_cache_debug(struc
 #endif
 }
 
-static inline void *fixup_red_left(struct kmem_cache *s, void *p)
+inline void *fixup_red_left(struct kmem_cache *s, void *p)
 {
 	if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
 		p += s->red_left_pad;

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/mm-kasan-account-for-object-redzone-in-slub-s-nearest_obj.patch