[PATCH] slab: redzone double-free detection

[PATCH] slab: redzone double-free detection

[Pekka Enberg]

From: Pekka Enberg <penberg@cs.helsinki.fi>

This patch adds double-free detection to redzone verification when freeing
an object. As explained by Manfred, when we are freeing an object, both
redzones should be RED_ACTIVE. However, if both are RED_INACTIVE, we are
trying to free an object that was already free'd.

Cc: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
---

 slab.c |   32 +++++++++++++++++++++++---------
 1 file changed, 23 insertions(+), 9 deletions(-)

diff --git a/mm/slab.c b/mm/slab.c
index e6ef9bd..7d982c1 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2585,6 +2585,28 @@ static void kfree_debugcheck(const void 
 	}
 }
 
+static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)
+{
+	unsigned long redzone1, redzone2;
+
+	redzone1 = *dbg_redzone1(cache, obj);
+	redzone2 = *dbg_redzone2(cache, obj);
+
+	/*
+	 * Redzone is ok.
+	 */
+	if (redzone1 == RED_ACTIVE && redzone2 == RED_ACTIVE)
+		return;
+
+	if (redzone1 == RED_INACTIVE && redzone2 == RED_INACTIVE)
+		slab_error(cache, "double free detected");
+	else
+		slab_error(cache, "memory outside object was overwritten");
+
+	printk(KERN_ERR "%p: redzone 1:0x%lx, redzone 2:0x%lx.\n",
+			obj, redzone1, redzone2);
+}
+
 static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
 				   void *caller)
 {
@@ -2608,15 +2630,7 @@ static void *cache_free_debugcheck(struc
 	slabp = page_get_slab(page);
 
 	if (cachep->flags & SLAB_RED_ZONE) {
-		if (*dbg_redzone1(cachep, objp) != RED_ACTIVE ||
-				*dbg_redzone2(cachep, objp) != RED_ACTIVE) {
-			slab_error(cachep, "double free, or memory outside"
-						" object was overwritten");
-			printk(KERN_ERR "%p: redzone 1:0x%lx, "
-					"redzone 2:0x%lx.\n",
-			       objp, *dbg_redzone1(cachep, objp),
-			       *dbg_redzone2(cachep, objp));
-		}
+		verify_redzone_free(cachep, objp);
 		*dbg_redzone1(cachep, objp) = RED_INACTIVE;
 		*dbg_redzone2(cachep, objp) = RED_INACTIVE;
 	}

Re: [PATCH] slab: redzone double-free detection

[Manfred Spraul]

Pekka Enberg wrote:

>From: Pekka Enberg <penberg@cs.helsinki.fi>
>
>This patch adds double-free detection to redzone verification when freeing
>an object. As explained by Manfred, when we are freeing an object, both
>redzones should be RED_ACTIVE. However, if both are RED_INACTIVE, we are
>trying to free an object that was already free'd.
>
>Cc: Manfred Spraul <manfred@colorfullife.com>
>Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
>  
>
Signed-Off-By: Manfred Spraul <manfred@colorfullife.com>

Re: [PATCH] slab: redzone double-free detection

[Andrew Morton]

Pekka Enberg <penberg@cs.helsinki.fi> wrote:
>
> From: Pekka Enberg <penberg@cs.helsinki.fi>
> 
> This patch adds double-free detection to redzone verification when freeing
> an object. As explained by Manfred, when we are freeing an object, both
> redzones should be RED_ACTIVE. However, if both are RED_INACTIVE, we are
> trying to free an object that was already free'd.
> 
> ...
>
>  slab.c |   32 +++++++++++++++++++++++---------

Nice, thanks.