github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 09:04:39 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

slab: validate slab before using it in alloc_single_from_partial()

Browse Source 
We touch slab->freelist and slab->inuse before checking the slab pointer
is actually sane. Do that validation first, which will be safer. We can
thus also remove the check from alloc_debug_processing().

This adds a new "s->flags & SLAB_CONSISTENCY_CHECKS" test but
alloc_single_from_partial() is only called for caches with debugging
enabled so it's acceptable.

In alloc_single_from_new_slab() we just created the struct slab and call
alloc_debug_processing() to mainly set up redzones, tracking etc, while
not really expecting the consistency checks to fail. Thus don't validate
it there.

Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
This commit is contained in:
Vlastimil Babka 2025-09-15 15:55:12 +02:00
parent 40522db59b
commit a21fe7b010
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
mm/slub.c
View File

@ -821,6 +821,8 @@ static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)
return *(unsigned int *)p;
}
#ifdef CONFIG_SLUB_DEBUG
/*
* For debugging context when we want to check if the struct slab pointer
* appears to be valid.
@ -830,7 +832,6 @@ static inline bool validate_slab_ptr(struct slab *slab)
return PageSlab(slab_page(slab));
}
#ifdef CONFIG_SLUB_DEBUG
static unsigned long object_map[BITS_TO_LONGS(MAX_OBJS_PER_PAGE)];
static DEFINE_SPINLOCK(object_map_lock);
@ -1651,11 +1652,6 @@ static noinline bool alloc_debug_processing(struct kmem_cache *s,
struct slab *slab, void *object, int orig_size)
{
if (s->flags & SLAB_CONSISTENCY_CHECKS) {
if (!validate_slab_ptr(slab)) {
slab_err(s, slab, "Not a valid slab page");
return false;
}
if (!alloc_consistency_checks(s, slab, object))
goto bad;
}
@ -2825,13 +2821,21 @@ static void *alloc_single_from_partial(struct kmem_cache *s,
lockdep_assert_held(&n->list_lock);
#ifdef CONFIG_SLUB_DEBUG
if (s->flags & SLAB_CONSISTENCY_CHECKS) {
if (!validate_slab_ptr(slab)) {
slab_err(s, slab, "Not a valid slab page");
return NULL;
}
}
#endif
object = slab->freelist;
slab->freelist = get_freepointer(s, object);
slab->inuse++;
if (!alloc_debug_processing(s, slab, object, orig_size)) {
if (validate_slab_ptr(slab))
remove_partial(n, slab);
remove_partial(n, slab);
return NULL;
}