On Fri, 31 Mar 2017 09:40:28 -0700 Kees Cook <keesc...@chromium.org> wrote:
> As found in PaX, this adds a cheap check on heap consistency, just to > notice if things have gotten corrupted in the page lookup. "As found in PaX" isn't a very illuminating justification for such a change. Was there a real kernel bug which this would have exposed, or what? > --- a/mm/slab.h > +++ b/mm/slab.h > @@ -384,6 +384,7 @@ static inline struct kmem_cache *cache_from_obj(struct > kmem_cache *s, void *x) > return s; > > page = virt_to_head_page(x); > + BUG_ON(!PageSlab(page)); > cachep = page->slab_cache; > if (slab_equal_or_root(cachep, s)) > return cachep; BUG_ON might be too severe. I expect the kindest VM_WARN_ON_ONCE() would suffice here, but without more details it is hard to say.
