kasan: fix krealloc handling for tag-based mode
authorAndrey Konovalov <andreyknvl@google.com>
Tue, 8 Jan 2019 23:23:18 +0000 (15:23 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Wed, 9 Jan 2019 01:15:11 +0000 (17:15 -0800)
commita3fe7cdf02e318870fb71218726cc2321ff41f30
tree3605d8bb1e03408527d97c5f8580b7acedabfaa2
parent96fedce27e1356a2fff1c270710d9405848db562
kasan: fix krealloc handling for tag-based mode

Right now tag-based KASAN can retag the memory that is reallocated via
krealloc and return a differently tagged pointer even if the same slab
object gets used and no reallocated technically happens.

There are a few issues with this approach.  One is that krealloc callers
can't rely on comparing the return value with the passed argument to
check whether reallocation happened.  Another is that if a caller knows
that no reallocation happened, that it can access object memory through
the old pointer, which leads to false positives.  Look at
nf_ct_ext_add() to see an example.

Fix this by keeping the same tag if the memory don't actually gets
reallocated during krealloc.

Link: http://lkml.kernel.org/r/bb2a71d17ed072bcc528cbee46fcbd71a6da3be4.1546540962.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/kasan/common.c