KFENCE annotations operate on untagged addresses. Untag addresses in KASAN runtime where they might be tagged.
Signed-off-by: Andrey Konovalov <[email protected]> --- This can be squashed into: revert kasan-remove-kfence-leftovers kfence, kasan: make KFENCE compatible with KASA --- mm/kasan/common.c | 2 +- mm/kasan/kasan.h | 12 +++++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index a390fae9d64b..fe852f3cfa42 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -416,7 +416,7 @@ static void *____kasan_kmalloc(struct kmem_cache *cache, const void *object, if (unlikely(object == NULL)) return NULL; - if (is_kfence_address(object)) + if (is_kfence_address(kasan_reset_tag(object))) return (void *)object; redzone_start = round_up((unsigned long)(object + size), diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 11c6e3650468..4fb8106f8e31 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -320,22 +320,28 @@ static inline u8 kasan_random_tag(void) { return 0; } static inline void kasan_poison(const void *address, size_t size, u8 value) { + address = kasan_reset_tag(address); + /* Skip KFENCE memory if called explicitly outside of sl*b. */ if (is_kfence_address(address)) return; - hw_set_mem_tag_range(kasan_reset_tag(address), + hw_set_mem_tag_range((void *)address, round_up(size, KASAN_GRANULE_SIZE), value); } static inline void kasan_unpoison(const void *address, size_t size) { + u8 tag = get_tag(address); + + address = kasan_reset_tag(address); + /* Skip KFENCE memory if called explicitly outside of sl*b. */ if (is_kfence_address(address)) return; - hw_set_mem_tag_range(kasan_reset_tag(address), - round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); + hw_set_mem_tag_range((void *)address, + round_up(size, KASAN_GRANULE_SIZE), tag); } static inline bool kasan_byte_accessible(const void *addr) -- 2.30.0.365.g02bc693789-goog
