[PATCH] mm/slab.c: Always check redzone after ctor is called

[Daniel Santos <danielfsantos@att.net>]

[-- Attachment #1: Type: text/plain, Size: 1 bytes --]



[-- Attachment #2: 0002-mm-slab.c-Always-redzone-after-constructor-is-called.patch --]
[-- Type: text/x-patch, Size: 1534 bytes --]

>From 1d21218309249ab6a28f931898a12bbb39fa512e Mon Sep 17 00:00:00 2001
From: Daniel Santos <daniel.santos@pobox.com>
Date: Fri, 10 Feb 2012 18:16:22 -0600
Subject: mm/slab.c: Always redzone after constructor is called.

If a cache is created with (SLAB_POISON | SLAB_RED_ZONE) and a
constructor, the redzone is not checked immediately after the
constructor is called (if SLAB_POISON is not specified, it is).
Although it does appear that an overwritten red zone will get detected
when the object is freed, it wont isolate the buffer overrun to the
constructor.
---
 mm/slab.c |   12 +++++++++++-
 1 files changed, 11 insertions(+), 1 deletions(-)

diff --git a/mm/slab.c b/mm/slab.c
index 1a618b2..9baa287 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3265,8 +3265,18 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
 	}
 #endif
 	objp += obj_offset(cachep);
-	if (cachep->ctor && cachep->flags & SLAB_POISON)
+	if (cachep->ctor && cachep->flags & SLAB_POISON) {
 		cachep->ctor(objp);
+		if (cachep->flags & SLAB_RED_ZONE) {
+			void * origp = objp - obj_offset(cachep);
+			if (*dbg_redzone2(cachep, origp) != RED_ACTIVE)
+				slab_error(cachep, "constructor overwrote the"
+						" end of an object");
+			if (*dbg_redzone1(cachep, origp) != RED_ACTIVE)
+				slab_error(cachep, "constructor overwrote the"
+						" start of an object");
+		}
+	}
 	if (ARCH_SLAB_MINALIGN &&
 	    ((unsigned long)objp & (ARCH_SLAB_MINALIGN-1))) {
 		printk(KERN_ERR "0x%p: not aligned to ARCH_SLAB_MINALIGN=%d\n",
-- 
1.7.3.4