• Andrey Ryabinin's avatar
    mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y · 00fb24a4
    Andrey Ryabinin authored
    The code like this:
    	ptr = kmalloc(size, GFP_KERNEL);
    	page = virt_to_page(ptr);
    	offset = offset_in_page(ptr);
    	kfree(page_address(page) + offset);
    may produce false-positive invalid-free reports on the kernel with
    In the example above we lose the original tag assigned to 'ptr', so
    kfree() gets the pointer with 0xFF tag.  In kfree() we check that 0xFF
    tag is different from the tag in shadow hence print false report.
    Instead of just comparing tags, do the following:
    1) Check that shadow doesn't contain KASAN_TAG_INVALID.  Otherwise it's
       double-free and it doesn't matter what tag the pointer have.
    2) If pointer tag is different from 0xFF, make sure that tag in the
       shadow is the same as in the pointer.
    Link: http://lkml.kernel.org/r/20190819172540.19581-1-aryabinin@virtuozzo.com
    Fixes: 7f94ffbc
     ("kasan: add hooks implementation for tag-based mode")
    Signed-off-by: default avatarAndrey Ryabinin <aryabinin@...>