diff mbox series

[mm,20/21] skbuff: use mempool KASAN hooks

Message ID	a3482c41395c69baa80eb59dbb06beef213d2a14.1703024586.git.andreyknvl@google.com
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel+bounces-6062-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161; From: andrey.konovalov@linux.dev To: Marco Elver <elver@google.com>, Alexander Potapenko <glider@google.com> Cc: Andrey Konovalov <andreyknvl@gmail.com>, Dmitry Vyukov <dvyukov@google.com>, Andrey Ryabinin <ryabinin.a.a@gmail.com>, kasan-dev@googlegroups.com, Evgenii Stepanov <eugenis@google.com>, Breno Leitao <leitao@debian.org>, Alexander Lobakin <alobakin@pm.me>, Andrew Morton <akpm@linux-foundation.org>, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov <andreyknvl@google.com> Subject: [PATCH mm 20/21] skbuff: use mempool KASAN hooks Date: Tue, 19 Dec 2023 23:29:04 +0100 Message-Id: <a3482c41395c69baa80eb59dbb06beef213d2a14.1703024586.git.andreyknvl@google.com> In-Reply-To: <cover.1703024586.git.andreyknvl@google.com> References: <cover.1703024586.git.andreyknvl@google.com> Precedence: bulk MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	kasan: save mempool stack traces \| [mm,00/21] kasan: save mempool stack traces [mm,01/21] kasan: rename kasan_slab_free_mempool to kasan_mempool_poison_object [mm,02/21] kasan: move kasan_mempool_poison_object [mm,03/21] kasan: document kasan_mempool_poison_object [mm,04/21] kasan: add return value for kasan_mempool_poison_object [mm,05/21] kasan: introduce kasan_mempool_unpoison_object [mm,06/21] kasan: introduce kasan_mempool_poison_pages [mm,07/21] kasan: introduce kasan_mempool_unpoison_pages [mm,08/21] kasan: clean up __kasan_mempool_poison_object [mm,09/21] kasan: save free stack traces for slab mempools [mm,10/21] kasan: clean up and rename ____kasan_kmalloc [mm,11/21] kasan: introduce poison_kmalloc_large_redzone [mm,12/21] kasan: save alloc stack traces for mempool [mm,13/21] mempool: skip slub_debug poisoning when KASAN is enabled [mm,14/21] mempool: use new mempool KASAN hooks [mm,15/21] mempool: introduce mempool_use_prealloc_only [mm,16/21] kasan: add mempool tests [mm,17/21] kasan: rename pagealloc tests [mm,18/21] kasan: reorder tests [mm,19/21] kasan: rename and document kasan_(un)poison_object_data [mm,20/21] skbuff: use mempool KASAN hooks [mm,21/21] io_uring: use mempool KASAN hook

Commit Message

andrey.konovalov@linux.dev Dec. 19, 2023, 10:29 p.m. UTC

  From: Andrey Konovalov <andreyknvl@google.com>

Instead of using slab-internal KASAN hooks for poisoning and unpoisoning
cached objects, use the proper mempool KASAN hooks.

Also check the return value of kasan_mempool_poison_object to prevent
double-free and invali-free bugs.

Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
 net/core/skbuff.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff mbox series

Patch

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 63bb6526399d..bb75b4272992 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -337,7 +337,7 @@  static struct sk_buff *napi_skb_cache_get(void)
 	}
 
 	skb = nc->skb_cache[--nc->skb_count];
-	kasan_unpoison_new_object(skbuff_cache, skb);
+	kasan_mempool_unpoison_object(skb, kmem_cache_size(skbuff_cache));
 
 	return skb;
 }
@@ -1309,13 +1309,15 @@  static void napi_skb_cache_put(struct sk_buff *skb)
 	struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache);
 	u32 i;
 
-	kasan_poison_new_object(skbuff_cache, skb);
+	if (!kasan_mempool_poison_object(skb))
+		return;
+
 	nc->skb_cache[nc->skb_count++] = skb;
 
 	if (unlikely(nc->skb_count == NAPI_SKB_CACHE_SIZE)) {
 		for (i = NAPI_SKB_CACHE_HALF; i < NAPI_SKB_CACHE_SIZE; i++)
-			kasan_unpoison_new_object(skbuff_cache,
-						  nc->skb_cache[i]);
+			kasan_mempool_unpoison_object(nc->skb_cache[i],
+						kmem_cache_size(skbuff_cache));
 
 		kmem_cache_free_bulk(skbuff_cache, NAPI_SKB_CACHE_HALF,
 				     nc->skb_cache + NAPI_SKB_CACHE_HALF);