Commit 58ce1fd5 authored by Pekka Enberg's avatar Pekka Enberg Committed by Linus Torvalds
Browse files

[PATCH] slab: redzone double-free detection 



At present our slab debugging tells us that it detected a double-free or
corruption - it does not distinguish between them.  Sometimes it's useful
to be able to differentiate between these two types of information.

Add double-free detection to redzone verification when freeing an object.
As explained by Manfred, when we are freeing an object, both redzones
should be RED_ACTIVE.  However, if both are RED_INACTIVE, we are trying to
free an object that was already free'd.

Signed-off-by: default avatarManfred Spraul <manfred@colorfullife.com>
Signed-off-by: default avatarPekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent b344e05c

mm/slab.c

+23 −9
Original line number Diff line number Diff line
@@ -2636,6 +2636,28 @@ static void kfree_debugcheck(const void *objp) 
	}

}



static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)

{

	unsigned long redzone1, redzone2;



	redzone1 = *dbg_redzone1(cache, obj);

	redzone2 = *dbg_redzone2(cache, obj);



	/*

	 * Redzone is ok.

	 */

	if (redzone1 == RED_ACTIVE && redzone2 == RED_ACTIVE)

		return;



	if (redzone1 == RED_INACTIVE && redzone2 == RED_INACTIVE)

		slab_error(cache, "double free detected");

	else

		slab_error(cache, "memory outside object was overwritten");



	printk(KERN_ERR "%p: redzone 1:0x%lx, redzone 2:0x%lx.\n",

			obj, redzone1, redzone2);

}



static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,

				   void *caller)

{
@@ -2659,15 +2681,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp, 
	slabp = page_get_slab(page);



	if (cachep->flags & SLAB_RED_ZONE) {

		if (*dbg_redzone1(cachep, objp) != RED_ACTIVE ||

				*dbg_redzone2(cachep, objp) != RED_ACTIVE) {

			slab_error(cachep, "double free, or memory outside"

						" object was overwritten");

			printk(KERN_ERR "%p: redzone 1:0x%lx, "

					"redzone 2:0x%lx.\n",

			       objp, *dbg_redzone1(cachep, objp),

			       *dbg_redzone2(cachep, objp));

		}

		verify_redzone_free(cachep, objp);

		*dbg_redzone1(cachep, objp) = RED_INACTIVE;

		*dbg_redzone2(cachep, objp) = RED_INACTIVE;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE