Skip to contentSkip to conversation

mm/slab.c: Always check redzone after ctor is called

PATCH New Daniel Santos 1 participant 1 message May 5, 2012 Memory management

lore
Share & tools
lore

Daniel Santos

author
#0 lore raw

PATCH 1/1 mm/slab.c: Always check redzone after ctor is called

Quoted 1 line

From 1d21218309249ab6a28f931898a12bbb39fa512e Mon Sep 17 00:00:00 2001

From: Daniel Santos <[email protected]>
Date: Fri, 10 Feb 2012 18:16:22 -0600
Subject: mm/slab.c: Always redzone after constructor is called.

If a cache is created with (SLAB_POISON | SLAB_RED_ZONE) and a constructor, the redzone is not checked immediately after the constructor is called (if SLAB_POISON is not specified, it is). Although it does appear that an overwritten red zone will get detected when the object is freed, it wont isolate the buffer overrun to the constructor.

---
 mm/slab.c |   12 +++++++++++-
 1 files changed, 11 insertions(+), 1 deletions(-)
mm/slab.c +11 -1
index 1a618b2..9baa287 100644
@@ -3265,8 +3265,18 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
 	}
 #endif
 	objp += obj_offset(cachep);
-	if (cachep->ctor && cachep->flags & SLAB_POISON)
+	if (cachep->ctor && cachep->flags & SLAB_POISON) {
 		cachep->ctor(objp);
+		if (cachep->flags & SLAB_RED_ZONE) {
+			void * origp = objp - obj_offset(cachep);
+			if (*dbg_redzone2(cachep, origp) != RED_ACTIVE)
+				slab_error(cachep, "constructor overwrote the"
+						" end of an object");
+			if (*dbg_redzone1(cachep, origp) != RED_ACTIVE)
+				slab_error(cachep, "constructor overwrote the"
+						" start of an object");
+		}
+	}
 	if (ARCH_SLAB_MINALIGN &&
 	    ((unsigned long)objp & (ARCH_SLAB_MINALIGN-1))) {
 		printk(KERN_ERR "0x%p: not aligned to ARCH_SLAB_MINALIGN=%d\n",
Signature · 1 line
1.7.3.4