mm/mempool: avoid KASAN marking mempool poison checks as use-after-free

MJDSys · torvalds · commit 7640131032db · 2016-03-11T16:17:47.000-08:00
When removing an element from the mempool, mark it as unpoisoned in KASAN
before verifying its contents for SLUB/SLAB debugging.  Otherwise KASAN
will flag the reads checking the element use-after-free writes as
use-after-free reads.

Signed-off-by: Matthew Dawson &lt;matthew@mjdsystems.ca&gt;
Acked-by: Andrey Ryabinin &lt;aryabinin@virtuozzo.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
diff --git a/mm/mempool.c b/mm/mempool.c
@@ -135,8 +135,8 @@ static void *remove_element(mempool_t *pool)
 	void *element = pool->elements[--pool->curr_nr];
 
 	BUG_ON(pool->curr_nr < 0);
-	check_element(pool, element);
 	kasan_unpoison_element(pool, element);
+	check_element(pool, element);
 	return element;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -135,8 +135,8 @@ static void remove_element(mempool_t pool)`
`135`	`135`	`void *element = pool->elements[--pool->curr_nr];`
`136`	`136`
`137`	`137`	`BUG_ON(pool->curr_nr < 0);`
`138`		`- check_element(pool, element);`
`139`	`138`	`kasan_unpoison_element(pool, element);`
	`139`	`+ check_element(pool, element);`
`140`	`140`	`return element;`
`141`	`141`	`}`
`142`	`142`