* [PATCH v2] kasan: Fix a type conversion error
[not found] <55F00E91.20409@virtuozzo.com>
@ 2015-09-09 11:04 ` Wang Long
0 siblings, 0 replies; only message in thread
From: Wang Long @ 2015-09-09 11:04 UTC (permalink / raw)
To: ryabinin.a.a, adech.fo
Cc: akpm, rusty, long.wanglong, linux-mm, linux-kernel, wanglong,
peifeiyue, morgan.wang
The current KASAN code can not find the following out-of-bounds
bugs:
char *ptr;
ptr = kmalloc(8, GFP_KERNEL);
memset(ptr+7, 0, 2);
the cause of the problem is the type conversion error in
*memory_is_poisoned_n* function. So this patch fix that.
Signed-off-by: Wang Long <long.wanglong@huawei.com>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
mm/kasan/kasan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 7b28e9c..5d65d06 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -204,7 +204,7 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr,
s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte);
if (unlikely(ret != (unsigned long)last_shadow ||
- ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow)))
+ ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow)))
return true;
}
return false;
--
1.8.3.4
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2015-09-09 11:04 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <55F00E91.20409@virtuozzo.com>
2015-09-09 11:04 ` [PATCH v2] kasan: Fix a type conversion error Wang Long
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®