Skip to content

Commit

Permalink
kasan: fix type cast in memory_is_poisoned_n
Browse files Browse the repository at this point in the history
Commit bb6e04a ("kasan: use internal prototypes matching gcc-13
builtins") introduced a bug into the memory_is_poisoned_n implementation:
it effectively removed the cast to a signed integer type after applying
KASAN_GRANULE_MASK.

As a result, KASAN started failing to properly check memset, memcpy, and
other similar functions.

Fix the bug by adding the cast back (through an additional signed integer
variable to make the code more readable).

Link: https://lkml.kernel.org/r/8c9e0251c2b8b81016255709d4ec42942dcaf018.1688431866.git.andreyknvl@google.com
Fixes: bb6e04a ("kasan: use internal prototypes matching gcc-13 builtins")
Signed-off-by: Andrey Konovalov <[email protected]>
Cc: Alexander Potapenko <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: Marco Elver <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
  • Loading branch information
xairy authored and akpm00 committed Jul 8, 2023
1 parent d3a808e commit 05c56e7
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion mm/kasan/generic.c
Original file line number Diff line number Diff line change
Expand Up @@ -130,9 +130,10 @@ static __always_inline bool memory_is_poisoned_n(const void *addr, size_t size)
if (unlikely(ret)) {
const void *last_byte = addr + size - 1;
s8 *last_shadow = (s8 *)kasan_mem_to_shadow(last_byte);
s8 last_accessible_byte = (unsigned long)last_byte & KASAN_GRANULE_MASK;

if (unlikely(ret != (unsigned long)last_shadow ||
(((long)last_byte & KASAN_GRANULE_MASK) >= *last_shadow)))
last_accessible_byte >= *last_shadow))
return true;
}
return false;
Expand Down

0 comments on commit 05c56e7

Please sign in to comment.