kasan: fix krealloc handling for tag-based mode

}

/*

 * Since it's desirable to only call object contructors once during slab

 * allocation, we preassign tags to all such objects. Also preassign tags for

 * SLAB_TYPESAFE_BY_RCU slabs to avoid use-after-free reports.

 * For SLAB allocator we can't preassign tags randomly since the freelist is

 * stored as an array of indexes instead of a linked list. Assign tags based

 * on objects indexes, so that objects that are next to each other get

 * different tags.

 * After a tag is assigned, the object always gets allocated with the same tag.

 * The reason is that we can't change tags for objects with constructors on

 * reallocation (even for non-SLAB_TYPESAFE_BY_RCU), because the constructor

 * code can save the pointer to the object somewhere (e.g. in the object

 * itself). Then if we retag it, the old saved pointer will become invalid.

 * This function assigns a tag to an object considering the following:

 * 1. A cache might have a constructor, which might save a pointer to a slab

 *    object somewhere (e.g. in the object itself). We preassign a tag for

 *    each object in caches with constructors during slab creation and reuse

 *    the same tag each time a particular object is allocated.

 * 2. A cache might be SLAB_TYPESAFE_BY_RCU, which means objects can be

 *    accessed after being freed. We preassign tags for objects in these

 *    caches as well.

 * 3. For SLAB allocator we can't preassign tags randomly since the freelist

 *    is stored as an array of indexes instead of a linked list. Assign tags

 *    based on objects indexes, so that objects that are next to each other

 *    get different tags.

 */

static u8 assign_tag(struct kmem_cache *cache, const void *object, bool new)

static u8 assign_tag(struct kmem_cache *cache, const void *object,

			bool init, bool krealloc)

{

	/* Reuse the same tag for krealloc'ed objects. */

	if (krealloc)

		return get_tag(object);

	/*

	 * If the cache neither has a constructor nor has SLAB_TYPESAFE_BY_RCU

	 * set, assign a tag when the object is being allocated (init == false).

	 */

	if (!cache->ctor && !(cache->flags & SLAB_TYPESAFE_BY_RCU))

		return new ? KASAN_TAG_KERNEL : random_tag();

		return init ? KASAN_TAG_KERNEL : random_tag();

	/* For caches that either have a constructor or SLAB_TYPESAFE_BY_RCU: */

#ifdef CONFIG_SLAB

	/* For SLAB assign tags based on the object index in the freelist. */

	return (u8)obj_to_index(cache, virt_to_page(object), (void *)object);

#else

	return new ? random_tag() : get_tag(object);

	/*

	 * For SLUB assign a random tag during slab creation, otherwise reuse

	 * the already assigned tag.

	 */

	return init ? random_tag() : get_tag(object);

#endif

}

	__memset(alloc_info, 0, sizeof(*alloc_info));

	if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))

		object = set_tag(object, assign_tag(cache, object, true));

		object = set_tag(object,

				assign_tag(cache, object, true, false));

	return (void *)object;

}

	return __kasan_slab_free(cache, object, ip, true);

}

void * __must_check kasan_kmalloc(struct kmem_cache *cache, const void *object,

					size_t size, gfp_t flags)

static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,

				size_t size, gfp_t flags, bool krealloc)

{

	unsigned long redzone_start;

	unsigned long redzone_end;

				KASAN_SHADOW_SCALE_SIZE);

	if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))

		tag = assign_tag(cache, object, false);

		tag = assign_tag(cache, object, false, krealloc);

	/* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */

	kasan_unpoison_shadow(set_tag(object, tag), size);

	return set_tag(object, tag);

}

void * __must_check kasan_kmalloc(struct kmem_cache *cache, const void *object,

				size_t size, gfp_t flags)

{

	return __kasan_kmalloc(cache, object, size, flags, false);

}

EXPORT_SYMBOL(kasan_kmalloc);

void * __must_check kasan_kmalloc_large(const void *ptr, size_t size,

	if (unlikely(!PageSlab(page)))

		return kasan_kmalloc_large(object, size, flags);

	else

		return kasan_kmalloc(page->slab_cache, object, size, flags);

		return __kasan_kmalloc(page->slab_cache, object, size,

						flags, true);

}

void kasan_poison_kfree(void *ptr, unsigned long ip)