Andrey Ryabinin 9b75a867cc mm: mempool: kasan: don't poot mempool objects in quarantine ... Currently we may put reserved by mempool elements into quarantine via kasan_kfree(). This is totally wrong since quarantine may really free these objects. So when mempool will try to use such element, use-after-free will happen. Or mempool may decide that it no longer need that element and double-free it. So don't put object into quarantine in kasan_kfree(), just poison it. Rename kasan_kfree() to kasan_poison_kfree() to respect that. Also, we shouldn't use kasan_slab_alloc()/kasan_krealloc() in kasan_unpoison_element() because those functions may update allocation stacktrace. This would be wrong for the most of the remove_element call sites. (The only call site where we may want to update alloc stacktrace is in mempool_alloc(). Kmemleak solves this by calling kmemleak_update_trace(), so we could make something like that too. But this is out of scope of this patch). Fixes: 55834c5909 ("mm: kasan: initial memory quarantine implementation") Link: http://lkml.kernel.org/r/575977C3.1010905@virtuozzo.com Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Reported-by: Kuthonuzo Luruo <kuthonuzo.luruo@hpe.com> Acked-by: Alexander Potapenko <glider@google.com> Cc: Dmitriy Vyukov <dvyukov@google.com> Cc: Kostya Serebryany <kcc@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2016-06-24 17:23:52 -07:00
..
kasan	mm: mempool: kasan: don't poot mempool objects in quarantine	2016-06-24 17:23:52 -07:00
backing-dev.c	mm: throttle on IO only when there are too many dirty and writeback pages	2016-05-20 17:58:30 -07:00
balloon_compaction.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2016-03-17 21:38:27 -07:00
bootmem.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
cleancache.c	cleancache: constify cleancache_ops structure	2016-01-27 09:09:57 -05:00
cma_debug.c
cma.c	mm/cma: silence warnings due to max() usage	2016-05-27 14:49:37 -07:00
cma.h
compaction.c	mm/compaction.c: fix zoneindex in kcompactd()	2016-05-20 17:58:30 -07:00
debug_page_ref.c	mm/page_ref: add tracepoint to track down page reference manipulation	2016-03-17 15:09:34 -07:00
debug.c	mm: introduce page reference manipulation functions	2016-03-17 15:09:34 -07:00
dmapool.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
early_ioremap.c	mm/early_ioremap: use offset_in_page macro	2015-11-05 19:34:48 -08:00
fadvise.c	mm/fadvise.c: do not discard partial pages with POSIX_FADV_DONTNEED	2016-06-09 14:23:11 -07:00
failslab.c	mm: fault-inject take over bootstrap kmem_cache check	2016-03-15 16:55:16 -07:00
filemap.c	Filesystem DAX locking for 4.7	2016-05-26 20:00:28 -07:00
frame_vector.c	mm/gup: Switch all callers of get_user_pages() to not pass tsk/mm	2016-02-16 10:11:12 +01:00
frontswap.c
gup.c	Merge branch 'mm-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-04-14 19:31:34 -07:00
highmem.c	mm/highmem: make nr_free_highpages() handles all highmem zones by itself	2016-05-19 19:12:14 -07:00
huge_memory.c	libnvdimm for 4.7	2016-05-23 11:18:01 -07:00
hugetlb_cgroup.c	mm, hugetlb_cgroup: round limit_in_bytes down to hugepage size	2016-05-20 17:58:30 -07:00
hugetlb.c	mm/hugetlb: fix huge page reserve accounting for private mappings	2016-06-09 14:23:11 -07:00
hwpoison-inject.c	hwpoison: use page_cgroup_ino for filtering by memcg	2015-09-10 13:29:01 -07:00
init-mm.c
internal.h	mm: make vm_mmap killable	2016-05-23 17:04:14 -07:00
interval_tree.c
Kconfig	mm: disable DEFERRED_STRUCT_PAGE_INIT on !NO_BOOTMEM	2016-05-27 14:49:37 -07:00
Kconfig.debug	mm/page_ref: add tracepoint to track down page reference manipulation	2016-03-17 15:09:34 -07:00
kmemcheck.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
kmemleak-test.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
kmemleak.c	mm: coalesce split strings	2016-03-17 15:09:34 -07:00
ksm.c	ksm: fix conflict between mmput and scan_get_next_rmap_item	2016-05-12 15:52:50 -07:00
list_lru.c	mm: memcontrol: move kmem accounting code to CONFIG_MEMCG	2016-01-20 17:09:18 -08:00
maccess.c	x86: remove more uaccess_32.h complexity	2016-05-22 17:21:27 -07:00
madvise.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
Makefile	z3fold: the 3-fold allocator for compressed pages	2016-05-20 17:58:30 -07:00
memblock.c	mm/memblock.c: remove unnecessary always-true comparison	2016-05-20 17:58:30 -07:00
memcontrol.c	revert "mm: memcontrol: fix possible css ref leak on oom"	2016-06-09 14:23:11 -07:00
memory_hotplug.c	mm: fix section mismatch warning	2016-05-27 15:23:32 -07:00
memory-failure.c	mm/memory-failure.c: replace "MCE" with "Memory failure"	2016-05-20 17:58:30 -07:00
memory.c	Filesystem DAX locking for 4.7	2016-05-26 20:00:28 -07:00
mempolicy.c	mm, page_alloc: avoid looking up the first zone in a zonelist twice	2016-05-19 19:12:14 -07:00
mempool.c	mm: mempool: kasan: don't poot mempool objects in quarantine	2016-06-24 17:23:52 -07:00
memtest.c	memtest: remove unused header files	2015-09-08 15:35:28 -07:00
migrate.c	mm: Export migrate_page_move_mapping and migrate_page_copy	2016-06-23 00:29:45 +02:00
mincore.c	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
mlock.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
mm_init.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
mmap.c	mm: remove more IS_ERR_VALUE abuses	2016-05-27 15:57:31 -07:00
mmu_context.c	mm/mmu_context, sched/core: Fix mmu_context.h assumption	2016-04-28 11:44:19 +02:00
mmu_notifier.c	fix Christoph's email addresses	2016-03-17 15:09:34 -07:00
mmzone.c	mm, page_alloc: inline the fast path of the zonelist iterator	2016-05-19 19:12:14 -07:00
mprotect.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
mremap.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
msync.c	mm/msync: use offset_in_page macro	2015-11-05 19:34:48 -08:00
nobootmem.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
nommu.c	mm: remove more IS_ERR_VALUE abuses	2016-05-27 15:57:31 -07:00
oom_kill.c	oom_reaper: avoid pointless atomic_inc_not_zero usage.	2016-06-24 17:23:52 -07:00
page_alloc.c	mm, page_alloc: recalculate the preferred zoneref if the context can ignore memory policies	2016-06-03 16:02:57 -07:00
page_counter.c	mm: page_counter: let page_counter_try_charge() return bool	2015-11-05 19:34:48 -08:00
page_ext.c	mm: use early_pfn_to_nid in page_ext_init	2016-05-27 14:49:37 -07:00
page_idle.c	mm: add page_check_address_transhuge() helper	2016-01-15 17:56:32 -08:00
page_io.c	Merge branch 'work.preadv2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-05-17 15:05:23 -07:00
page_isolation.c	mm/memory_hotplug: add comment to some functions related to memory hotplug	2016-05-19 19:12:14 -07:00
page_owner.c	mm: check the return value of lookup_page_ext for all call sites	2016-06-03 15:06:22 -07:00
page_poison.c	mm: check the return value of lookup_page_ext for all call sites	2016-06-03 15:06:22 -07:00
page-writeback.c	writeback: use higher precision calculation in domain_dirty_limits()	2016-05-30 08:54:40 -06:00
pagewalk.c	thp: rename split_huge_page_pmd() to split_huge_pmd()	2016-01-15 17:56:32 -08:00
percpu-km.c	mm: percpu: use pr_fmt to prefix output	2016-03-17 15:09:34 -07:00
percpu-vm.c
percpu.c	percpu: fix synchronization between synchronous map extension and chunk destruction	2016-05-25 11:48:25 -04:00
pgtable-generic.c	mm/thp/migration: switch from flush_tlb_range to flush_pmd_tlb_range	2016-03-17 15:09:34 -07:00
process_vm_access.c	mm/gup: Introduce get_user_pages_remote()	2016-02-16 10:04:09 +01:00
quicklist.c	fix Christoph's email addresses	2016-03-17 15:09:34 -07:00
readahead.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
rmap.c	mm: thp: avoid false positive VM_BUG_ON_PAGE in page_move_anon_rmap()	2016-05-27 14:49:37 -07:00
shmem.c	tmpfs: don't undo fallocate past its last page	2016-06-24 17:23:52 -07:00
slab_common.c	mm: kasan: initial memory quarantine implementation	2016-05-20 17:58:30 -07:00
slab.c	mm, kasan: don't call kasan_krealloc() from ksize().	2016-05-20 17:58:30 -07:00
slab.h	mm: kasan: initial memory quarantine implementation	2016-05-20 17:58:30 -07:00
slob.c	mm: slab: free kmem_cache_node after destroy sysfs file	2016-02-18 16:23:24 -08:00
slub.c	mm, kasan: don't call kasan_krealloc() from ksize().	2016-05-20 17:58:30 -07:00
sparse-vmemmap.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
sparse.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
swap_cgroup.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
swap_state.c	mm: thp: broken page count after commit aa88b68c3b	2016-06-09 14:23:11 -07:00
swap.c	mm: introduce dedicated WQ_MEM_RECLAIM workqueue to do lru_add_drain_all	2016-06-09 14:23:11 -07:00
swapfile.c	mm: thp: calculate the mapcount correctly for THP pages during WP faults	2016-05-12 15:52:50 -07:00
truncate.c	dax: New fault locking	2016-05-19 15:20:54 -06:00
userfaultfd.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
util.c	mm: make vm_mmap killable	2016-05-23 17:04:14 -07:00
vmacache.c	mm/vmacache: inline vmacache_valid_mm()	2015-11-05 19:34:48 -08:00
vmalloc.c	mm: fix overflow in vm_map_ram()	2016-06-03 15:06:22 -07:00
vmpressure.c	mm/vmpressure.c: fix subtree pressure detection	2016-02-03 08:28:43 -08:00
vmscan.c	mm, oom: rework oom detection	2016-05-20 17:58:30 -07:00
vmstat.c	mm: check the return value of lookup_page_ext for all call sites	2016-06-03 15:06:22 -07:00
workingset.c	mm: workingset: make shadow node shrinker memcg aware	2016-03-17 15:09:34 -07:00
z3fold.c	mm/z3fold.c: avoid modifying HEADLESS page and minor cleanup	2016-06-03 16:02:55 -07:00
zbud.c	mm/zbud.c: use list_last_entry() instead of list_tail_entry()	2016-01-15 11:40:52 -08:00
zpool.c	mm: zsmalloc: constify struct zs_pool name	2015-11-06 17:50:42 -08:00
zsmalloc.c	update "mm/zsmalloc: don't fail if can't create debugfs info"	2016-05-26 15:35:44 -07:00
zswap.c	mm/zswap: use workqueue to destroy pool	2016-05-20 17:58:30 -07:00