1 files changed, 15 insertions, 6 deletions

diff --git a/mm/slab.c b/mm/slab.c
index 73fe23e649c9..91c1863df93d 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -666,8 +666,10 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries,
         struct alien_cache *alc = NULL;
 
         alc = kmalloc_node(memsize, gfp, node);
-        init_arraycache(&alc->ac, entries, batch);
-        spin_lock_init(&alc->lock);
+        if (alc) {
+                init_arraycache(&alc->ac, entries, batch);
+                spin_lock_init(&alc->lock);
+        }
         return alc;
 }
 
@@ -2357,7 +2359,7 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
         void *freelist;
         void *addr = page_address(page);
 
-        page->s_mem = kasan_reset_tag(addr) + colour_off;
+        page->s_mem = addr + colour_off;
         page->active = 0;
 
         if (OBJFREELIST_SLAB(cachep))
@@ -2366,6 +2368,7 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
                 /* Slab management obj is off-slab. */
                 freelist = kmem_cache_alloc_node(cachep->freelist_cache,
                                               local_flags, nodeid);
+                freelist = kasan_reset_tag(freelist);
                 if (!freelist)
                         return NULL;
         } else {
@@ -2679,6 +2682,13 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
 
         offset *= cachep->colour_off;
 
+        /*
+         * Call kasan_poison_slab() before calling alloc_slabmgmt(), so
+         * page_address() in the latter returns a non-tagged pointer,
+         * as it should be for slab pages.
+         */
+        kasan_poison_slab(page);
+
         /* Get slab management. */
         freelist = alloc_slabmgmt(cachep, page, offset,
                         local_flags & ~GFP_CONSTRAINT_MASK, page_node);
@@ -2687,7 +2697,6 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
 
         slab_map_pages(cachep, page, freelist);
 
-        kasan_poison_slab(page);
         cache_init_objs(cachep, page);
 
         if (gfpflags_allow_blocking(local_flags))
@@ -3538,7 +3547,6 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
 {
         void *ret = slab_alloc(cachep, flags, _RET_IP_);
 
-        ret = kasan_slab_alloc(cachep, ret, flags);
         trace_kmem_cache_alloc(_RET_IP_, ret,
                                cachep->object_size, cachep->size, flags);
 
@@ -3628,7 +3636,6 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid)
 {
         void *ret = slab_alloc_node(cachep, flags, nodeid, _RET_IP_);
 
-        ret = kasan_slab_alloc(cachep, ret, flags);
         trace_kmem_cache_alloc_node(_RET_IP_, ret,
                                     cachep->object_size, cachep->size,
                                     flags, nodeid);
@@ -4406,6 +4413,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
         unsigned int objnr;
         unsigned long offset;
 
+        ptr = kasan_reset_tag(ptr);
+
         /* Find and validate object. */
         cachep = page->slab_cache;
         objnr = obj_to_index(cachep, page, (void *)ptr);