[PATCH] slab: redzone double-free detection

At present our slab debugging tells us that it detected a double-free or
corruption - it does not distinguish between them.  Sometimes it's useful
to be able to differentiate between these two types of information.

Add double-free detection to redzone verification when freeing an object.
As explained by Manfred, when we are freeing an object, both redzones
should be RED_ACTIVE.  However, if both are RED_INACTIVE, we are trying to
free an object that was already free'd.

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 23 insertions, 9 deletions

diff --git a/mm/slab.c b/mm/slab.c
index 54bd2eb3f2f6..2046da2aa46e 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2636,6 +2636,28 @@ static void kfree_debugcheck(const void *objp)
         }
 }
 
+static inline void verify_redzone_free(struct kmem_cache *cache, void *obj)
+{
+        unsigned long redzone1, redzone2;
+
+        redzone1 = *dbg_redzone1(cache, obj);
+        redzone2 = *dbg_redzone2(cache, obj);
+
+        /*
+         * Redzone is ok.
+         */
+        if (redzone1 == RED_ACTIVE && redzone2 == RED_ACTIVE)
+                return;
+
+        if (redzone1 == RED_INACTIVE && redzone2 == RED_INACTIVE)
+                slab_error(cache, "double free detected");
+        else
+                slab_error(cache, "memory outside object was overwritten");
+
+        printk(KERN_ERR "%p: redzone 1:0x%lx, redzone 2:0x%lx.\n",
+                        obj, redzone1, redzone2);
+}
+
 static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
                                    void *caller)
 {
@@ -2659,15 +2681,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
         slabp = page_get_slab(page);
 
         if (cachep->flags & SLAB_RED_ZONE) {
-                if (*dbg_redzone1(cachep, objp) != RED_ACTIVE ||
-                                *dbg_redzone2(cachep, objp) != RED_ACTIVE) {
-                        slab_error(cachep, "double free, or memory outside"
-                                                " object was overwritten");
-                        printk(KERN_ERR "%p: redzone 1:0x%lx, "
-                                        "redzone 2:0x%lx.\n",
-                               objp, *dbg_redzone1(cachep, objp),
-                               *dbg_redzone2(cachep, objp));
-                }
+                verify_redzone_free(cachep, objp);
                 *dbg_redzone1(cachep, objp) = RED_INACTIVE;
                 *dbg_redzone2(cachep, objp) = RED_INACTIVE;
         }