Commit 804aa132 authored by Laura Abbott's avatar Laura Abbott Committed by Linus Torvalds

slub: fix/clean free_debug_processing return paths

Since commit 19c7ff9e ("slub: Take node lock during object free
checks") check_object has been incorrectly returning success as it
follows the out label which just returns the node.

Thanks to refactoring, the out and fail paths are now basically the
same.  Combine the two into one and just use a single label.

Credit to Mathias Krause for the original work which inspired this
series
Signed-off-by: default avatarLaura Abbott <labbott@fedoraproject.org>
Acked-by: default avatarChristoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Mathias Krause <minipli@googlemail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 282acb43
...@@ -1053,24 +1053,25 @@ static noinline int free_debug_processing( ...@@ -1053,24 +1053,25 @@ static noinline int free_debug_processing(
void *object = head; void *object = head;
int cnt = 0; int cnt = 0;
unsigned long uninitialized_var(flags); unsigned long uninitialized_var(flags);
int ret = 0;
spin_lock_irqsave(&n->list_lock, flags); spin_lock_irqsave(&n->list_lock, flags);
slab_lock(page); slab_lock(page);
if (!check_slab(s, page)) if (!check_slab(s, page))
goto fail; goto out;
next_object: next_object:
cnt++; cnt++;
if (!check_valid_pointer(s, page, object)) { if (!check_valid_pointer(s, page, object)) {
slab_err(s, page, "Invalid object pointer 0x%p", object); slab_err(s, page, "Invalid object pointer 0x%p", object);
goto fail; goto out;
} }
if (on_freelist(s, page, object)) { if (on_freelist(s, page, object)) {
object_err(s, page, object, "Object already free"); object_err(s, page, object, "Object already free");
goto fail; goto out;
} }
if (!check_object(s, page, object, SLUB_RED_ACTIVE)) if (!check_object(s, page, object, SLUB_RED_ACTIVE))
...@@ -1087,7 +1088,7 @@ static noinline int free_debug_processing( ...@@ -1087,7 +1088,7 @@ static noinline int free_debug_processing(
} else } else
object_err(s, page, object, object_err(s, page, object,
"page slab pointer corrupt."); "page slab pointer corrupt.");
goto fail; goto out;
} }
if (s->flags & SLAB_STORE_USER) if (s->flags & SLAB_STORE_USER)
...@@ -1101,6 +1102,8 @@ static noinline int free_debug_processing( ...@@ -1101,6 +1102,8 @@ static noinline int free_debug_processing(
object = get_freepointer(s, object); object = get_freepointer(s, object);
goto next_object; goto next_object;
} }
ret = 1;
out: out:
if (cnt != bulk_cnt) if (cnt != bulk_cnt)
slab_err(s, page, "Bulk freelist count(%d) invalid(%d)\n", slab_err(s, page, "Bulk freelist count(%d) invalid(%d)\n",
...@@ -1108,13 +1111,9 @@ static noinline int free_debug_processing( ...@@ -1108,13 +1111,9 @@ static noinline int free_debug_processing(
slab_unlock(page); slab_unlock(page);
spin_unlock_irqrestore(&n->list_lock, flags); spin_unlock_irqrestore(&n->list_lock, flags);
return 1; if (!ret)
slab_fix(s, "Object at 0x%p not freed", object);
fail: return ret;
slab_unlock(page);
spin_unlock_irqrestore(&n->list_lock, flags);
slab_fix(s, "Object at 0x%p not freed", object);
return 0;
} }
static int __init setup_slub_debug(char *str) static int __init setup_slub_debug(char *str)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment