kmalloc_double_kzfree() would corrupt kernel memory when the just
freed memory were allocated by another thread before the second
call to kfree_sensitive() and the new allocation tag happened to
match the old one.
This could not happen in GENERIC mode as it uses quarantine.
Signed-off-by: Wang Wensheng <wsw9603@163.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
---
v1->v2:
Update comment suggested by Andrey Konovalov.
--
mm/kasan/kasan_test_c.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
index 32d06cbf6a31..3f4ed29178b3 100644
--- a/mm/kasan/kasan_test_c.c
+++ b/mm/kasan/kasan_test_c.c
@@ -874,6 +874,16 @@ static void kmalloc_double_kzfree(struct kunit *test)
char *ptr;
size_t size = 16;
+ /*
+ * With the tag-based KASAN modes, if the memory happens to be
+ * reallocated between the two frees and the new allocation tag happens
+ * to match the old one, the second free will cause a memory corruption.
+ * Resolving https://bugzilla.kernel.org/show_bug.cgi?id=212177 would
+ * help to deal with this. With Generic KASAN, it's effectively
+ * impossible for the memory to get reallocated due to the quarantine.
+ */
+ KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC);
+
ptr = kmalloc(size, GFP_KERNEL);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
--
2.43.0