1 files changed, 29 insertions, 36 deletions

diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index b6f99e81bfeb..88af13c00d3c 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -442,11 +442,6 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object)
         kasan_poison_shadow(object,
                         round_up(cache->object_size, KASAN_SHADOW_SCALE_SIZE),
                         KASAN_KMALLOC_REDZONE);
-        if (cache->flags & SLAB_KASAN) {
-                struct kasan_alloc_meta *alloc_info =
-                        get_alloc_info(cache, object);
-                alloc_info->state = KASAN_STATE_INIT;
-        }
 }
 
 static inline int in_irqentry_text(unsigned long ptr)
@@ -510,6 +505,17 @@ struct kasan_free_meta *get_free_info(struct kmem_cache *cache,
         return (void *)object + cache->kasan_info.free_meta_offset;
 }
 
+void kasan_init_slab_obj(struct kmem_cache *cache, const void *object)
+{
+        struct kasan_alloc_meta *alloc_info;
+
+        if (!(cache->flags & SLAB_KASAN))
+                return;
+
+        alloc_info = get_alloc_info(cache, object);
+        __memset(alloc_info, 0, sizeof(*alloc_info));
+}
+
 void kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags)
 {
         kasan_kmalloc(cache, object, cache->object_size, flags);
@@ -529,34 +535,26 @@ static void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
 
 bool kasan_slab_free(struct kmem_cache *cache, void *object)
 {
+        s8 shadow_byte;
+
         /* RCU slabs could be legally used after free within the RCU period */
         if (unlikely(cache->flags & SLAB_DESTROY_BY_RCU))
                 return false;
 
-        if (likely(cache->flags & SLAB_KASAN)) {
-                struct kasan_alloc_meta *alloc_info;
-                struct kasan_free_meta *free_info;
+        shadow_byte = READ_ONCE(*(s8 *)kasan_mem_to_shadow(object));
+        if (shadow_byte < 0 || shadow_byte >= KASAN_SHADOW_SCALE_SIZE) {
+                kasan_report_double_free(cache, object, shadow_byte);
+                return true;
+        }
 
-                alloc_info = get_alloc_info(cache, object);
-                free_info = get_free_info(cache, object);
+        kasan_poison_slab_free(cache, object);
 
-                switch (alloc_info->state) {
-                case KASAN_STATE_ALLOC:
-                        alloc_info->state = KASAN_STATE_QUARANTINE;
-                        quarantine_put(free_info, cache);
-                        set_track(&free_info->track, GFP_NOWAIT);
-                        kasan_poison_slab_free(cache, object);
-                        return true;
-                case KASAN_STATE_QUARANTINE:
-                case KASAN_STATE_FREE:
-                        pr_err("Double free");
-                        dump_stack();
-                        break;
-                default:
-                        break;
-                }
-        }
-        return false;
+        if (unlikely(!(cache->flags & SLAB_KASAN)))
+                return false;
+
+        set_track(&get_alloc_info(cache, object)->free_track, GFP_NOWAIT);
+        quarantine_put(get_free_info(cache, object), cache);
+        return true;
 }
 
 void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
@@ -565,7 +563,7 @@ void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
         unsigned long redzone_start;
         unsigned long redzone_end;
 
-        if (flags & __GFP_RECLAIM)
+        if (gfpflags_allow_blocking(flags))
                 quarantine_reduce();
 
         if (unlikely(object == NULL))
@@ -579,14 +577,9 @@ void kasan_kmalloc(struct kmem_cache *cache, const void *object, size_t size,
         kasan_unpoison_shadow(object, size);
         kasan_poison_shadow((void *)redzone_start, redzone_end - redzone_start,
                 KASAN_KMALLOC_REDZONE);
-        if (cache->flags & SLAB_KASAN) {
-                struct kasan_alloc_meta *alloc_info =
-                        get_alloc_info(cache, object);
 
-                alloc_info->state = KASAN_STATE_ALLOC;
-                alloc_info->alloc_size = size;
-                set_track(&alloc_info->track, flags);
-        }
+        if (cache->flags & SLAB_KASAN)
+                set_track(&get_alloc_info(cache, object)->alloc_track, flags);
 }
 EXPORT_SYMBOL(kasan_kmalloc);
 
@@ -596,7 +589,7 @@ void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags)
         unsigned long redzone_start;
         unsigned long redzone_end;
 
-        if (flags & __GFP_RECLAIM)
+        if (gfpflags_allow_blocking(flags))
                 quarantine_reduce();
 
         if (unlikely(ptr == NULL))