Merge tag 'hardening-v6.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees...

[platform/kernel/linux-starfive.git] / mm / slab_common.c

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 3e49bb8..1cba98a 100644 (file)
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -1348,11 +1348,11 @@ __do_krealloc(const void *p, size_t new_size, gfp_t flags)
        void *ret;
        size_t ks;
 
-       /* Don't use instrumented ksize to allow precise KASAN poisoning. */
+       /* Check for double-free before calling ksize. */
        if (likely(!ZERO_OR_NULL_PTR(p))) {
                if (!kasan_check_byte(p))
                        return NULL;
-               ks = kfence_ksize(p) ?: __ksize(p);
+               ks = ksize(p);
        } else
                ks = 0;
 
@@ -1420,21 +1420,21 @@ void kfree_sensitive(const void *p)
        void *mem = (void *)p;
 
        ks = ksize(mem);
-       if (ks)
+       if (ks) {
+               kasan_unpoison_range(mem, ks);
                memzero_explicit(mem, ks);
+       }
        kfree(mem);
 }
 EXPORT_SYMBOL(kfree_sensitive);
 
 size_t ksize(const void *objp)
 {
-       size_t size;
-
        /*
-        * We need to first check that the pointer to the object is valid, and
-        * only then unpoison the memory. The report printed from ksize() is
-        * more useful, then when it's printed later when the behaviour could
-        * be undefined due to a potential use-after-free or double-free.
+        * We need to first check that the pointer to the object is valid.
+        * The KASAN report printed from ksize() is more useful, then when
+        * it's printed later when the behaviour could be undefined due to
+        * a potential use-after-free or double-free.
         *
         * We use kasan_check_byte(), which is supported for the hardware
         * tag-based KASAN mode, unlike kasan_check_read/write().
@@ -1448,13 +1448,7 @@ size_t ksize(const void *objp)
        if (unlikely(ZERO_OR_NULL_PTR(objp)) || !kasan_check_byte(objp))
                return 0;
 
-       size = kfence_ksize(objp) ?: __ksize(objp);
-       /*
-        * We assume that ksize callers could use whole allocated area,
-        * so we need to unpoison this area.
-        */
-       kasan_unpoison_range(objp, size);
-       return size;
+       return kfence_ksize(objp) ?: __ksize(objp);
 }
 EXPORT_SYMBOL(ksize);