Messages in this thread | | | From | "Luruo, Kuthonuzo" <> | Subject | RE: [PATCH v2 1/2] mm, kasan: improve double-free detection | Date | Mon, 9 May 2016 06:04:28 +0000 |
| |
> >> Thank you for the review! > >> > >> > > + switch (alloc_data.state) { > >> > > + case KASAN_STATE_QUARANTINE: > >> > > + case KASAN_STATE_FREE: > >> > > + kasan_report((unsigned long)object, 0, false, > >> > > + (unsigned long)__builtin_return_address(1)); > >> > > >> > __builtin_return_address() is unsafe if argument is non-zero. Use > >> > return_address() instead. > >> > >> hmm, I/cscope can't seem to find an x86 implementation for > return_address(). > >> Will dig further; thanks. > >> > > > > It seems there's no generic interface to obtain return address. x86 > > has working __builtin_return_address() and it's ok with it, others > > use their own return_adderss(), and ok as well. > > > > I think unification is needed here. > > > We use _RET_IP_ in other places in portable part of kasan.
Yeah, _RET_IP_ is the way to go here.
Not directly related but: while looking into kasan_slab_free() callers, it seems to me that, with SLAB + quarantine, kasan_poison_kfree() should _not_ be calling into kasan_slab_free(). The intent in the call-chain thru kasan_poison_kree() seems to be only to poison object shadow, not actually free it.
Alexander, can you please comment/confirm? Thanks.
Kuthonuzo
| |