lkml.org 
[lkml]   [2019]   [Sep]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v5] kasan: add memory corruption identification for software tag-based mode
From
Date
> >  const char *get_bug_type(struct kasan_access_info *info)
> > {
> > +#ifdef CONFIG_KASAN_SW_TAGS_IDENTIFY
> > + struct kasan_alloc_meta *alloc_meta;
> > + struct kmem_cache *cache;
> > + struct page *page;
> > + const void *addr;
> > + void *object;
> > + u8 tag;
> > + int i;
> > +
> > + tag = get_tag(info->access_addr);
> > + addr = reset_tag(info->access_addr);
> > + page = kasan_addr_to_page(addr);
> > + if (page && PageSlab(page)) {
> > + cache = page->slab_cache;
> > + object = nearest_obj(cache, page, (void *)addr);
> > + alloc_meta = get_alloc_info(cache, object);
> > +
> > + for (i = 0; i < KASAN_NR_FREE_STACKS; i++)
> > + if (alloc_meta->free_pointer_tag[i] == tag)
> > + return "use-after-free";
> > + return "out-of-bounds";
>
> I think we should keep the "invalid-access" bug type here if we failed
> to identify the bug as a "use-after-free" (and change the patch
> description accordingly).
>
> Other than that:
>
> Acked-by: Andrey Konovalov <andreyknvl@google.com>
>
Thanks your suggestion.
If slab records is not found, it may be use-after-free or out-of-bounds.
Maybe We can think how to avoid the situation(check object range or
other?), if possible, I will send patch or adopt your suggestion
modification.

regards,
Walter

\
 
 \ /
  Last update: 2019-09-04 05:42    [W:0.048 / U:1.940 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site