From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751539AbbIIEAY (ORCPT ); Wed, 9 Sep 2015 00:00:24 -0400 Received: from szxga02-in.huawei.com ([119.145.14.65]:7050 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754806AbbIIEAB (ORCPT ); Wed, 9 Sep 2015 00:00:01 -0400 From: Wang Long To: , CC: , , , , , , , Subject: [PATCH 2/2] kasan: Fix a type conversion error Date: Wed, 9 Sep 2015 03:59:40 +0000 Message-ID: <1441771180-206648-3-git-send-email-long.wanglong@huawei.com> X-Mailer: git-send-email 1.8.3.4 In-Reply-To: <1441771180-206648-1-git-send-email-long.wanglong@huawei.com> References: <1441771180-206648-1-git-send-email-long.wanglong@huawei.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.107.193.248] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The current KASAN code can find the following out-of-bounds bugs: char *ptr; ptr = kmalloc(8, GFP_KERNEL); memset(ptr+7, 0, 2); the cause of the problem is the type conversion error in *memory_is_poisoned_n* function. So this patch fix that. Signed-off-by: Wang Long --- mm/kasan/kasan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c index 7b28e9c..5d65d06 100644 --- a/mm/kasan/kasan.c +++ b/mm/kasan/kasan.c @@ -204,7 +204,7 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr, s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); if (unlikely(ret != (unsigned long)last_shadow || - ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) + ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) return true; } return false; -- 1.8.3.4