>From 1d21218309249ab6a28f931898a12bbb39fa512e Mon Sep 17 00:00:00 2001 From: Daniel Santos Date: Fri, 10 Feb 2012 18:16:22 -0600 Subject: mm/slab.c: Always redzone after constructor is called. If a cache is created with (SLAB_POISON | SLAB_RED_ZONE) and a constructor, the redzone is not checked immediately after the constructor is called (if SLAB_POISON is not specified, it is). Although it does appear that an overwritten red zone will get detected when the object is freed, it wont isolate the buffer overrun to the constructor. --- mm/slab.c | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index 1a618b2..9baa287 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -3265,8 +3265,18 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep, } #endif objp += obj_offset(cachep); - if (cachep->ctor && cachep->flags & SLAB_POISON) + if (cachep->ctor && cachep->flags & SLAB_POISON) { cachep->ctor(objp); + if (cachep->flags & SLAB_RED_ZONE) { + void * origp = objp - obj_offset(cachep); + if (*dbg_redzone2(cachep, origp) != RED_ACTIVE) + slab_error(cachep, "constructor overwrote the" + " end of an object"); + if (*dbg_redzone1(cachep, origp) != RED_ACTIVE) + slab_error(cachep, "constructor overwrote the" + " start of an object"); + } + } if (ARCH_SLAB_MINALIGN && ((unsigned long)objp & (ARCH_SLAB_MINALIGN-1))) { printk(KERN_ERR "0x%p: not aligned to ARCH_SLAB_MINALIGN=%d\n", -- 1.7.3.4