diff options
| author |   Pekka Enberg <penberg@cs.helsinki.fi> | 2006-06-23 02:03:24 -0700 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@g5.osdl.org> | 2006-06-23 07:42:49 -0700 |
| commit | 58ce1fd5805647a58a050bbbbd2252ea5ecb47b3 (patch) | |
| tree | 639aa44f21d0176c771b8b6e76d9c7ce9e2d1d19 /mm | |
| parent | [PATCH] likely cleanup: remove unlikely in sys_mprotect() (diff) | |
| download | linux-dev-58ce1fd5805647a58a050bbbbd2252ea5ecb47b3.tar.xz linux-dev-58ce1fd5805647a58a050bbbbd2252ea5ecb47b3.zip | |
[PATCH] slab: redzone double-free detection
At present our slab debugging tells us that it detected a double-free or
corruption - it does not distinguish between them. Sometimes it's useful
to be able to differentiate between these two types of information.
Add double-free detection to redzone verification when freeing an object.
As explained by Manfred, when we are freeing an object, both redzones
should be RED_ACTIVE. However, if both are RED_INACTIVE, we are trying to
free an object that was already free'd.
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/slab.c | 32 |
1 files changed, 23 insertions, 9 deletions
diff --git a/mm/slab.c b/mm/slab.c index 54bd2eb3f2f6..2046da2aa46e 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -2636,6 +2636,28 @@ static void kfree_debugcheck(const void *objp) } } +static inline void verify_redzone_free(struct kmem_cache *cache, void *obj) +{ + unsigned long redzone1, redzone2; + + redzone1 = *dbg_redzone1(cache, obj); + redzone2 = *dbg_redzone2(cache, obj); + + /* + * Redzone is ok. + */ + if (redzone1 == RED_ACTIVE && redzone2 == RED_ACTIVE) + return; + + if (redzone1 == RED_INACTIVE && redzone2 == RED_INACTIVE) + slab_error(cache, "double free detected"); + else + slab_error(cache, "memory outside object was overwritten"); + + printk(KERN_ERR "%p: redzone 1:0x%lx, redzone 2:0x%lx.\n", + obj, redzone1, redzone2); +} + static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp, void *caller) { @@ -2659,15 +2681,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp, slabp = page_get_slab(page); if (cachep->flags & SLAB_RED_ZONE) { - if (*dbg_redzone1(cachep, objp) != RED_ACTIVE || - *dbg_redzone2(cachep, objp) != RED_ACTIVE) { - slab_error(cachep, "double free, or memory outside" - " object was overwritten"); - printk(KERN_ERR "%p: redzone 1:0x%lx, " - "redzone 2:0x%lx.\n", - objp, *dbg_redzone1(cachep, objp), - *dbg_redzone2(cachep, objp)); - } + verify_redzone_free(cachep, objp); *dbg_redzone1(cachep, objp) = RED_INACTIVE; *dbg_redzone2(cachep, objp) = RED_INACTIVE; } |