mm/slub.c: fix wrong address during slab padding restoration (5d682681) · Commits · 戴 / test

Start address calculated for slab padding restoration was wrong. Wrong address would point to some section before padding and could cause corruption Link: http://lkml.kernel.org/r/1516604578-4577-1-git-send-email-balasubramani_vivekanandan@mentor.com Signed-off-by:

Balasubramani Vivekanandan <balasubramani_vivekanandan@mentor.com> Cc: Christoph Lameter <cl@linux.com> Cc: Pekka Enberg <penberg@kernel.org> Cc: David Rientjes <rientjes@google.com> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Signed-off-by:

mm/slub.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -838,6 +838,7 @@ static int slab_pad_check(struct kmem_cache s, struct page page)
		u8 *start;
		u8 *fault;
		u8 *end;
		u8 *pad;
		int length;
		int remainder;

		@@ -851,8 +852,9 @@ static int slab_pad_check(struct kmem_cache s, struct page page)
		if (!remainder)
		return 1;

		pad = end - remainder;
		metadata_access_enable();
		fault = memchr_inv(end - remainder, POISON_INUSE, remainder);
		fault = memchr_inv(pad, POISON_INUSE, remainder);
		metadata_access_disable();
		if (!fault)
		return 1;
		@@ -860,9 +862,9 @@ static int slab_pad_check(struct kmem_cache s, struct page page)
		end--;

		slab_err(s, page, "Padding overwritten. 0x%p-0x%p", fault, end - 1);
		print_section(KERN_ERR, "Padding ", end - remainder, remainder);
		print_section(KERN_ERR, "Padding ", pad, remainder);

		restore_bytes(s, "slab padding", POISON_INUSE, end - remainder, end);
		restore_bytes(s, "slab padding", POISON_INUSE, fault, end);
		return 0;
		}