From: Andrey Konovalov <andreyk...@google.com> [ Upstream commit 219667c23c68eb3dbc0d5662b9246f28477fe529 ]
Similarly to commit 96fedce27e13 ("kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY"), we need to reset pointer tags in __check_heap_object() in mm/slab.c before doing any pointer math. Link: http://lkml.kernel.org/r/9a5c0f958db10e69df5ff9f2b997866b56b7effc.1550602886.git.andreyk...@google.com Signed-off-by: Andrey Konovalov <andreyk...@google.com> Tested-by: Qian Cai <c...@lca.pw> Cc: Alexander Potapenko <gli...@google.com> Cc: Andrey Ryabinin <aryabi...@virtuozzo.com> Cc: Catalin Marinas <catalin.mari...@arm.com> Cc: Dmitry Vyukov <dvyu...@google.com> Cc: Evgeniy Stepanov <euge...@google.com> Cc: Kostya Serebryany <k...@google.com> Cc: Vincenzo Frascino <vincenzo.frasc...@arm.com> Signed-off-by: Andrew Morton <a...@linux-foundation.org> Signed-off-by: Linus Torvalds <torva...@linux-foundation.org> Signed-off-by: Sasha Levin <sas...@kernel.org> --- mm/slab.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/slab.c b/mm/slab.c index 09df506ae830..409631e49295 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -4415,6 +4415,8 @@ const char *__check_heap_object(const void *ptr, unsigned long n, unsigned int objnr; unsigned long offset; + ptr = kasan_reset_tag(ptr); + /* Find and validate object. */ cachep = page->slab_cache; objnr = obj_to_index(cachep, page, (void *)ptr); -- 2.19.1