[PATCH] slab: redzone double-free detection
At present our slab debugging tells us that it detected a double-free or corruption - it does not distinguish between them. Sometimes it's useful to be able to differentiate between these two types of information. Add double-free detection to redzone verification when freeing an object. As explained by Manfred, when we are freeing an object, both redzones should be RED_ACTIVE. However, if both are RED_INACTIVE, we are trying to free an object that was already free'd. Signed-off-by: Manfred Spraul <manfred@colorfullife.com> Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
b344e05c58
commit
58ce1fd580
32
mm/slab.c
32
mm/slab.c
|
@ -2636,6 +2636,28 @@ static void kfree_debugcheck(const void *objp)
|
|||
}
|
||||
}
|
||||
|
||||
static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)
|
||||
{
|
||||
unsigned long redzone1, redzone2;
|
||||
|
||||
redzone1 = *dbg_redzone1(cache, obj);
|
||||
redzone2 = *dbg_redzone2(cache, obj);
|
||||
|
||||
/*
|
||||
* Redzone is ok.
|
||||
*/
|
||||
if (redzone1 == RED_ACTIVE && redzone2 == RED_ACTIVE)
|
||||
return;
|
||||
|
||||
if (redzone1 == RED_INACTIVE && redzone2 == RED_INACTIVE)
|
||||
slab_error(cache, "double free detected");
|
||||
else
|
||||
slab_error(cache, "memory outside object was overwritten");
|
||||
|
||||
printk(KERN_ERR "%p: redzone 1:0x%lx, redzone 2:0x%lx.\n",
|
||||
obj, redzone1, redzone2);
|
||||
}
|
||||
|
||||
static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
|
||||
void *caller)
|
||||
{
|
||||
|
@ -2659,15 +2681,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
|
|||
slabp = page_get_slab(page);
|
||||
|
||||
if (cachep->flags & SLAB_RED_ZONE) {
|
||||
if (*dbg_redzone1(cachep, objp) != RED_ACTIVE ||
|
||||
*dbg_redzone2(cachep, objp) != RED_ACTIVE) {
|
||||
slab_error(cachep, "double free, or memory outside"
|
||||
" object was overwritten");
|
||||
printk(KERN_ERR "%p: redzone 1:0x%lx, "
|
||||
"redzone 2:0x%lx.\n",
|
||||
objp, *dbg_redzone1(cachep, objp),
|
||||
*dbg_redzone2(cachep, objp));
|
||||
}
|
||||
verify_redzone_free(cachep, objp);
|
||||
*dbg_redzone1(cachep, objp) = RED_INACTIVE;
|
||||
*dbg_redzone2(cachep, objp) = RED_INACTIVE;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue