On Mon, Aug 1, 2016 at 4:55 PM, Andrey Ryabinin <[email protected]> wrote: > > > On 07/28/2016 06:31 PM, Alexander Potapenko wrote: >> When free_meta_offset is not zero, it is usually aligned on 4 bytes, >> because the size of preceding kasan_alloc_meta is aligned on 4 bytes. >> As a result, accesses to kasan_free_meta fields may be misaligned. >> >> Signed-off-by: Alexander Potapenko <[email protected]> >> --- >> mm/kasan/kasan.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c >> index 6845f92..0379551 100644 >> --- a/mm/kasan/kasan.c >> +++ b/mm/kasan/kasan.c >> @@ -390,7 +390,8 @@ void kasan_cache_create(struct kmem_cache *cache, size_t >> *size, >> /* Add free meta. */ >> if (cache->flags & SLAB_DESTROY_BY_RCU || cache->ctor || >> cache->object_size < sizeof(struct kasan_free_meta)) { >> - cache->kasan_info.free_meta_offset = *size; >> + cache->kasan_info.free_meta_offset = >> + ALIGN(*size, sizeof(void *)); > > This cannot work. Well, it does, at least on my tests. > I slightly changed metadata layout in > http://lkml.kernel.org/g/<[email protected]> > which should also fix UBSAN's complain. Thanks, will take a look. >> *size += sizeof(struct kasan_free_meta); >> } >> redzone_adjust = optimal_redzone(cache->object_size) - >>
-- Alexander Potapenko Software Engineer Google Germany GmbH Erika-Mann-Straße, 33 80636 München Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg
