Skip to content

Commit 05c56e7

Browse files
xairyakpm00
authored andcommitted
kasan: fix type cast in memory_is_poisoned_n
Commit bb6e04a ("kasan: use internal prototypes matching gcc-13 builtins") introduced a bug into the memory_is_poisoned_n implementation: it effectively removed the cast to a signed integer type after applying KASAN_GRANULE_MASK. As a result, KASAN started failing to properly check memset, memcpy, and other similar functions. Fix the bug by adding the cast back (through an additional signed integer variable to make the code more readable). Link: https://lkml.kernel.org/r/8c9e0251c2b8b81016255709d4ec42942dcaf018.1688431866.git.andreyknvl@google.com Fixes: bb6e04a ("kasan: use internal prototypes matching gcc-13 builtins") Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Marco Elver <elver@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
1 parent d3a808e commit 05c56e7

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

mm/kasan/generic.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,10 @@ static __always_inline bool memory_is_poisoned_n(const void *addr, size_t size)
130130
if (unlikely(ret)) {
131131
const void *last_byte = addr + size - 1;
132132
s8 *last_shadow = (s8 *)kasan_mem_to_shadow(last_byte);
133+
s8 last_accessible_byte = (unsigned long)last_byte & KASAN_GRANULE_MASK;
133134

134135
if (unlikely(ret != (unsigned long)last_shadow ||
135-
(((long)last_byte & KASAN_GRANULE_MASK) >= *last_shadow)))
136+
last_accessible_byte >= *last_shadow))
136137
return true;
137138
}
138139
return false;

0 commit comments

Comments
 (0)