kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY
commit96fedce27e1356a2fff1c270710d9405848db562
authorAndrey Konovalov <andreyknvl@google.com>
Tue, 8 Jan 2019 23:23:15 +0000 (8 15:23 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Wed, 9 Jan 2019 01:15:11 +0000 (8 17:15 -0800)
tree740a5d338824604bc88f4faa6398a17e8a8f0204
parenteb214f2dda31ffa989033b1e0f848ba0d3cb6188
kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY

With CONFIG_HARDENED_USERCOPY enabled __check_heap_object() compares and
then subtracts a potentially tagged pointer with a non-tagged address of
the page that this pointer belongs to, which leads to unexpected
behavior.

Untag the pointer in __check_heap_object() before doing any of these
operations.

Link: http://lkml.kernel.org/r/7e756a298d514c4482f52aea6151db34818d395d.1546540962.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/slub.c