+1 -1

arch/arm64/kernel/sleep.S

reviewed

··· 134 134 */ 135 135 bl cpu_do_resume 136 136 137 137 - #if defined(CONFIG_KASAN) && CONFIG_KASAN_STACK 137 137 + #if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK) 138 138 mov x0, sp 139 139 bl kasan_unpoison_task_stack_below 140 140 #endif

+1 -1

arch/csky/Kconfig

reviewed

··· 314 314 int "Maximum zone order" 315 315 default "11" 316 316 317 317 - config RAM_BASE 317 317 + config DRAM_BASE 318 318 hex "DRAM start addr (the same with memory-section in dts)" 319 319 default 0x0 320 320

+1 -1

arch/csky/include/asm/page.h

reviewed

··· 28 28 #define SSEG_SIZE 0x20000000 29 29 #define LOWMEM_LIMIT (SSEG_SIZE * 2) 30 30 31 31 - #define PHYS_OFFSET_OFFSET (CONFIG_RAM_BASE & (SSEG_SIZE - 1)) 31 31 + #define PHYS_OFFSET_OFFSET (CONFIG_DRAM_BASE & (SSEG_SIZE - 1)) 32 32 33 33 #ifndef __ASSEMBLY__ 34 34

-2

arch/ia64/configs/generic_defconfig

reviewed

··· 55 55 CONFIG_SCSI_FC_ATTRS=y 56 56 CONFIG_SCSI_SYM53C8XX_2=y 57 57 CONFIG_SCSI_QLOGIC_1280=y 58 58 - CONFIG_ATA=y 59 59 - CONFIG_ATA_PIIX=y 60 58 CONFIG_SATA_VITESSE=y 61 59 CONFIG_MD=y 62 60 CONFIG_BLK_DEV_MD=m

+3 -3

arch/ia64/mm/discontig.c

reviewed

··· 95 95 * acpi_boot_init() (which builds the node_to_cpu_mask array) hasn't been 96 96 * called yet. Note that node 0 will also count all non-existent cpus. 97 97 */ 98 98 - static int __meminit early_nr_cpus_node(int node) 98 98 + static int early_nr_cpus_node(int node) 99 99 { 100 100 int cpu, n = 0; 101 101 ··· 110 110 * compute_pernodesize - compute size of pernode data 111 111 * @node: the node id. 112 112 */ 113 113 - static unsigned long __meminit compute_pernodesize(int node) 113 113 + static unsigned long compute_pernodesize(int node) 114 114 { 115 115 unsigned long pernodesize = 0, cpus; 116 116 ··· 367 367 } 368 368 } 369 369 370 370 - static void __meminit scatter_node_data(void) 370 370 + static void scatter_node_data(void) 371 371 { 372 372 pg_data_t **dst; 373 373 int node;

+1 -1

arch/x86/kernel/acpi/wakeup_64.S

reviewed

··· 115 115 movq pt_regs_r14(%rax), %r14 116 116 movq pt_regs_r15(%rax), %r15 117 117 118 118 - #if defined(CONFIG_KASAN) && CONFIG_KASAN_STACK 118 118 + #if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK) 119 119 /* 120 120 * The suspend path may have poisoned some areas deeper in the stack, 121 121 * which we now need to unpoison.

+1 -1

include/linux/kasan.h

reviewed

··· 330 330 331 331 #endif /* CONFIG_KASAN */ 332 332 333 333 - #if defined(CONFIG_KASAN) && CONFIG_KASAN_STACK 333 333 + #if defined(CONFIG_KASAN) && defined(CONFIG_KASAN_STACK) 334 334 void kasan_unpoison_task_stack(struct task_struct *task); 335 335 #else 336 336 static inline void kasan_unpoison_task_stack(struct task_struct *task) {}

+1 -1

kernel/gcov/clang.c

reviewed

··· 369 369 INIT_LIST_HEAD(&fn_dup->head); 370 370 371 371 cv_size = fn->num_counters * sizeof(fn->counters[0]); 372 372 - fn_dup->counters = vmalloc(cv_size); 372 372 + fn_dup->counters = kvmalloc(cv_size, GFP_KERNEL); 373 373 if (!fn_dup->counters) { 374 374 kfree(fn_dup); 375 375 return NULL;

+2 -7

lib/Kconfig.kasan

reviewed

··· 138 138 139 139 endchoice 140 140 141 141 - config KASAN_STACK_ENABLE 141 141 + config KASAN_STACK 142 142 bool "Enable stack instrumentation (unsafe)" if CC_IS_CLANG && !COMPILE_TEST 143 143 depends on KASAN_GENERIC || KASAN_SW_TAGS 144 144 + default y if CC_IS_GCC 144 145 help 145 146 The LLVM stack address sanitizer has a know problem that 146 147 causes excessive stack usage in a lot of functions, see ··· 154 153 but clang users can still enable it for builds without 155 154 CONFIG_COMPILE_TEST. On gcc it is assumed to always be safe 156 155 to use and enabled by default. 157 157 - 158 158 - config KASAN_STACK 159 159 - int 160 160 - depends on KASAN_GENERIC || KASAN_SW_TAGS 161 161 - default 1 if KASAN_STACK_ENABLE || CC_IS_GCC 162 162 - default 0 163 156 164 157 config KASAN_SW_TAGS_IDENTIFY 165 158 bool "Enable memory corruption identification"

+2 -2

lib/earlycpio.c

reviewed

··· 40 40 }; 41 41 42 42 /** 43 43 - * cpio_data find_cpio_data - Search for files in an uncompressed cpio 43 43 + * find_cpio_data - Search for files in an uncompressed cpio 44 44 * @path: The directory to search for, including a slash at the end 45 45 * @data: Pointer to the cpio archive or a header inside 46 46 * @len: Remaining length of the cpio based on data pointer ··· 49 49 * matching file itself. It can be used to iterate through the cpio 50 50 * to find all files inside of a directory path. 51 51 * 52 52 - * @return: struct cpio_data containing the address, length and 52 52 + * Return: &struct cpio_data containing the address, length and 53 53 * filename (with the directory path cut off) of the found file. 54 54 * If you search for a filename and not for files in a directory, 55 55 * pass the absolute path of the filename in the cpio and make sure

+2 -1

lib/lru_cache.c

reviewed

··· 76 76 /** 77 77 * lc_create - prepares to track objects in an active set 78 78 * @name: descriptive name only used in lc_seq_printf_stats and lc_seq_dump_details 79 79 + * @cache: cache root pointer 79 80 * @max_pending_changes: maximum changes to accumulate until a transaction is required 80 81 * @e_count: number of elements allowed to be active simultaneously 81 82 * @e_size: size of the tracked objects ··· 628 627 } 629 628 630 629 /** 631 631 - * lc_dump - Dump a complete LRU cache to seq in textual form. 630 630 + * lc_seq_dump_details - Dump a complete LRU cache to seq in textual form. 632 631 * @lc: the lru cache to operate on 633 632 * @seq: the &struct seq_file pointer to seq_printf into 634 633 * @utext: user supplied additional "heading" or other info

+2 -2

lib/parman.c

reviewed

··· 297 297 * parman_prio_init - initializes a parman priority chunk 298 298 * @parman: parman instance 299 299 * @prio: parman prio structure to be initialized 300 300 - * @prority: desired priority of the chunk 300 300 + * @priority: desired priority of the chunk 301 301 * 302 302 * Note: all locking must be provided by the caller. 303 303 * ··· 356 356 EXPORT_SYMBOL(parman_item_add); 357 357 358 358 /** 359 359 - * parman_item_del - deletes parman item 359 359 + * parman_item_remove - deletes parman item 360 360 * @parman: parman instance 361 361 * @prio: parman prio instance to delete the item from 362 362 * @item: parman item instance

+6 -5

lib/radix-tree.c

reviewed

··· 166 166 /** 167 167 * radix_tree_find_next_bit - find the next set bit in a memory region 168 168 * 169 169 - * @addr: The address to base the search on 170 170 - * @size: The bitmap size in bits 171 171 - * @offset: The bitnumber to start searching at 169 169 + * @node: where to begin the search 170 170 + * @tag: the tag index 171 171 + * @offset: the bitnumber to start searching at 172 172 * 173 173 * Unrollable variant of find_next_bit() for constant size arrays. 174 174 * Tail bits starting from size to roundup(size, BITS_PER_LONG) must be zero. ··· 461 461 462 462 /** 463 463 * radix_tree_shrink - shrink radix tree to minimum height 464 464 - * @root radix tree root 464 464 + * @root: radix tree root 465 465 */ 466 466 static inline bool radix_tree_shrink(struct radix_tree_root *root) 467 467 { ··· 691 691 } 692 692 693 693 /** 694 694 - * __radix_tree_insert - insert into a radix tree 694 694 + * radix_tree_insert - insert into a radix tree 695 695 * @root: radix tree root 696 696 * @index: index key 697 697 * @item: item to insert ··· 919 919 /** 920 920 * radix_tree_iter_replace - replace item in a slot 921 921 * @root: radix tree root 922 922 + * @iter: iterator state 922 923 * @slot: pointer to slot 923 924 * @item: new item to store in the slot. 924 925 *

+1 -1

mm/kasan/common.c

reviewed

··· 63 63 kasan_unpoison(address, size); 64 64 } 65 65 66 66 - #if CONFIG_KASAN_STACK 66 66 + #ifdef CONFIG_KASAN_STACK 67 67 /* Unpoison the entire stack for a task. */ 68 68 void kasan_unpoison_task_stack(struct task_struct *task) 69 69 {

+1 -1

mm/kasan/kasan.h

reviewed

··· 231 231 const char *kasan_get_bug_type(struct kasan_access_info *info); 232 232 void kasan_metadata_fetch_row(char *buffer, void *row); 233 233 234 234 - #if defined(CONFIG_KASAN_GENERIC) && CONFIG_KASAN_STACK 234 234 + #if defined(CONFIG_KASAN_GENERIC) && defined(CONFIG_KASAN_STACK) 235 235 void kasan_print_address_stack_frame(const void *addr); 236 236 #else 237 237 static inline void kasan_print_address_stack_frame(const void *addr) { }

+1 -1

mm/kasan/report_generic.c

reviewed

··· 128 128 memcpy(buffer, kasan_mem_to_shadow(row), META_BYTES_PER_ROW); 129 129 } 130 130 131 131 - #if CONFIG_KASAN_STACK 131 131 + #ifdef CONFIG_KASAN_STACK 132 132 static bool __must_check tokenize_frame_descr(const char **frame_descr, 133 133 char *token, size_t max_tok_len, 134 134 unsigned long *value)

+2

mm/mapping_dirty_helpers.c

reviewed

··· 165 165 return 0; 166 166 } 167 167 168 168 + #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD 168 169 /* Huge pud */ 169 170 walk->action = ACTION_CONTINUE; 170 171 if (pud_trans_huge(pudval) || pud_devmap(pudval)) 171 172 WARN_ON(pud_write(pudval) || pud_dirty(pudval)); 173 173 + #endif 172 174 173 175 return 0; 174 176 }

+19 -10

mm/mmu_gather.c

reviewed

··· 249 249 tlb_flush_mmu_free(tlb); 250 250 } 251 251 252 252 - /** 253 253 - * tlb_gather_mmu - initialize an mmu_gather structure for page-table tear-down 254 254 - * @tlb: the mmu_gather structure to initialize 255 255 - * @mm: the mm_struct of the target address space 256 256 - * @fullmm: @mm is without users and we're going to destroy the full address 257 257 - * space (exit/execve) 258 258 - * 259 259 - * Called to initialize an (on-stack) mmu_gather structure for page-table 260 260 - * tear-down from @mm. 261 261 - */ 262 252 static void __tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, 263 253 bool fullmm) 264 254 { ··· 273 283 inc_tlb_flush_pending(tlb->mm); 274 284 } 275 285 286 286 + /** 287 287 + * tlb_gather_mmu - initialize an mmu_gather structure for page-table tear-down 288 288 + * @tlb: the mmu_gather structure to initialize 289 289 + * @mm: the mm_struct of the target address space 290 290 + * 291 291 + * Called to initialize an (on-stack) mmu_gather structure for page-table 292 292 + * tear-down from @mm. 293 293 + */ 276 294 void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm) 277 295 { 278 296 __tlb_gather_mmu(tlb, mm, false); 279 297 } 280 298 299 299 + /** 300 300 + * tlb_gather_mmu_fullmm - initialize an mmu_gather structure for page-table tear-down 301 301 + * @tlb: the mmu_gather structure to initialize 302 302 + * @mm: the mm_struct of the target address space 303 303 + * 304 304 + * In this case, @mm is without users and we're going to destroy the 305 305 + * full address space (exit/execve). 306 306 + * 307 307 + * Called to initialize an (on-stack) mmu_gather structure for page-table 308 308 + * tear-down from @mm. 309 309 + */ 281 310 void tlb_gather_mmu_fullmm(struct mmu_gather *tlb, struct mm_struct *mm) 282 311 { 283 312 __tlb_gather_mmu(tlb, mm, true);

+1 -1

mm/oom_kill.c

reviewed

··· 170 170 return false; 171 171 } 172 172 173 173 - /** 173 173 + /* 174 174 * Check whether unreclaimable slab amount is greater than 175 175 * all user memory(LRU pages). 176 176 * dump_unreclaimable_slab() could help in the case that

+1 -1

mm/ptdump.c

reviewed

··· 111 111 unsigned long next, struct mm_walk *walk) 112 112 { 113 113 struct ptdump_state *st = walk->private; 114 114 - pte_t val = READ_ONCE(*pte); 114 114 + pte_t val = ptep_get(pte); 115 115 116 116 if (st->effective_prot) 117 117 st->effective_prot(st, 4, pte_val(val));

+2 -2

mm/shuffle.c

reviewed

··· 147 147 spin_unlock_irqrestore(&z->lock, flags); 148 148 } 149 149 150 150 - /** 151 151 - * shuffle_free_memory - reduce the predictability of the page allocator 150 150 + /* 151 151 + * __shuffle_free_memory - reduce the predictability of the page allocator 152 152 * @pgdat: node page data 153 153 */ 154 154 void __meminit __shuffle_free_memory(pg_data_t *pgdat)

+13 -7

scripts/Makefile.kasan

reviewed

··· 2 2 CFLAGS_KASAN_NOSANITIZE := -fno-builtin 3 3 KASAN_SHADOW_OFFSET ?= $(CONFIG_KASAN_SHADOW_OFFSET) 4 4 5 5 + cc-param = $(call cc-option, -mllvm -$(1), $(call cc-option, --param $(1))) 6 6 + 7 7 + ifdef CONFIG_KASAN_STACK 8 8 + stack_enable := 1 9 9 + else 10 10 + stack_enable := 0 11 11 + endif 12 12 + 5 13 ifdef CONFIG_KASAN_GENERIC 6 14 7 15 ifdef CONFIG_KASAN_INLINE ··· 19 11 endif 20 12 21 13 CFLAGS_KASAN_MINIMAL := -fsanitize=kernel-address 22 22 - 23 23 - cc-param = $(call cc-option, -mllvm -$(1), $(call cc-option, --param $(1))) 24 14 25 15 # -fasan-shadow-offset fails without -fsanitize 26 16 CFLAGS_KASAN_SHADOW := $(call cc-option, -fsanitize=kernel-address \ ··· 33 27 CFLAGS_KASAN := $(CFLAGS_KASAN_SHADOW) \ 34 28 $(call cc-param,asan-globals=1) \ 35 29 $(call cc-param,asan-instrumentation-with-call-threshold=$(call_threshold)) \ 36 36 - $(call cc-param,asan-stack=$(CONFIG_KASAN_STACK)) \ 30 30 + $(call cc-param,asan-stack=$(stack_enable)) \ 37 31 $(call cc-param,asan-instrument-allocas=1) 38 32 endif 39 33 ··· 42 36 ifdef CONFIG_KASAN_SW_TAGS 43 37 44 38 ifdef CONFIG_KASAN_INLINE 45 45 - instrumentation_flags := -mllvm -hwasan-mapping-offset=$(KASAN_SHADOW_OFFSET) 39 39 + instrumentation_flags := $(call cc-param,hwasan-mapping-offset=$(KASAN_SHADOW_OFFSET)) 46 40 else 47 47 - instrumentation_flags := -mllvm -hwasan-instrument-with-calls=1 41 41 + instrumentation_flags := $(call cc-param,hwasan-instrument-with-calls=1) 48 42 endif 49 43 50 44 CFLAGS_KASAN := -fsanitize=kernel-hwaddress \ 51 51 - -mllvm -hwasan-instrument-stack=$(CONFIG_KASAN_STACK) \ 52 52 - -mllvm -hwasan-use-short-granules=0 \ 45 45 + $(call cc-param,hwasan-instrument-stack=$(stack_enable)) \ 46 46 + $(call cc-param,hwasan-use-short-granules=0) \ 53 47 $(instrumentation_flags) 54 48 55 49 endif # CONFIG_KASAN_SW_TAGS

+2 -2

security/Kconfig.hardening

reviewed

··· 64 64 config GCC_PLUGIN_STRUCTLEAK_BYREF 65 65 bool "zero-init structs passed by reference (strong)" 66 66 depends on GCC_PLUGINS 67 67 - depends on !(KASAN && KASAN_STACK=1) 67 67 + depends on !(KASAN && KASAN_STACK) 68 68 select GCC_PLUGIN_STRUCTLEAK 69 69 help 70 70 Zero-initialize any structures on the stack that may ··· 82 82 config GCC_PLUGIN_STRUCTLEAK_BYREF_ALL 83 83 bool "zero-init anything passed by reference (very strong)" 84 84 depends on GCC_PLUGINS 85 85 - depends on !(KASAN && KASAN_STACK=1) 85 85 + depends on !(KASAN && KASAN_STACK) 86 86 select GCC_PLUGIN_STRUCTLEAK 87 87 help 88 88 Zero-initialize any stack variables that may be passed

-3

tools/arch/ia64/include/asm/barrier.h

reviewed

··· 39 39 * sequential memory pages only. 40 40 */ 41 41 42 42 - /* XXX From arch/ia64/include/uapi/asm/gcc_intrin.h */ 43 43 - #define ia64_mf() asm volatile ("mf" ::: "memory") 44 44 - 45 42 #define mb() ia64_mf() 46 43 #define rmb() mb() 47 44 #define wmb() mb()

-2

tools/include/uapi/asm/errno.h

reviewed

··· 9 9 #include "../../../arch/alpha/include/uapi/asm/errno.h" 10 10 #elif defined(__mips__) 11 11 #include "../../../arch/mips/include/uapi/asm/errno.h" 12 12 - #elif defined(__ia64__) 13 13 - #include "../../../arch/ia64/include/uapi/asm/errno.h" 14 12 #elif defined(__xtensa__) 15 13 #include "../../../arch/xtensa/include/uapi/asm/errno.h" 16 14 #else