On Fri, May 17, 2019 at 3:26 AM Kees Cook [off-list ref] wrote:

On Tue, May 14, 2019 at 04:35:34PM +0200, Alexander Potapenko wrote:

quoted

[...]

diff --git a/mm/slab.h b/mm/slab.h
index 43ac818b8592..24ae887359b8 100644
--- a/mm/slab.h
+++ b/mm/slab.h

@@ -524,4 +524,20 @@ static inline int cache_random_seq_create(struct kmem_cache *cachep,

[...]
+static inline bool slab_want_init_on_free(struct kmem_cache *c)
+{
+     if (static_branch_unlikely(&init_on_free))
+             return !(c->ctor);

BTW, why is this checking for c->ctor here? Shouldn't it not matter for
the free case?

It does matter, see e.g. the handling of __OBJECT_POISON in slub.c
If we just return true here, the kernel crashes.

quoted

+     else
+             return false;
+}

--
Kees Cook

-- 
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg