poison.h 2.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. #ifndef _LINUX_POISON_H
  3. #define _LINUX_POISON_H
  4. /********** include/linux/list.h **********/
  5. /*
  6. * Architectures might want to move the poison pointer offset
  7. * into some well-recognized area such as 0xdead000000000000,
  8. * that is also not mappable by user-space exploits:
  9. */
  10. #ifdef CONFIG_ILLEGAL_POINTER_VALUE
  11. # define POISON_POINTER_DELTA _AC(CONFIG_ILLEGAL_POINTER_VALUE, UL)
  12. #else
  13. # define POISON_POINTER_DELTA 0
  14. #endif
  15. #ifdef __cplusplus
  16. #define LIST_POISON1 NULL
  17. #define LIST_POISON2 NULL
  18. #else
  19. /*
  20. * These are non-NULL pointers that will result in page faults
  21. * under normal circumstances, used to verify that nobody uses
  22. * non-initialized list entries.
  23. */
  24. #define LIST_POISON1 ((void *) 0x100 + POISON_POINTER_DELTA)
  25. #define LIST_POISON2 ((void *) 0x200 + POISON_POINTER_DELTA)
  26. #endif
  27. /********** include/linux/timer.h **********/
  28. /*
  29. * Magic number "tsta" to indicate a static timer initializer
  30. * for the object debugging code.
  31. */
  32. #define TIMER_ENTRY_STATIC ((void *) 0x300 + POISON_POINTER_DELTA)
  33. /********** mm/page_poison.c **********/
  34. #define PAGE_POISON 0xaa
  35. /********** mm/page_alloc.c ************/
  36. #define TAIL_MAPPING ((void *) 0x400 + POISON_POINTER_DELTA)
  37. /********** mm/slab.c **********/
  38. /*
  39. * Magic nums for obj red zoning.
  40. * Placed in the first word before and the first word after an obj.
  41. */
  42. #define RED_INACTIVE 0x09F911029D74E35BULL /* when obj is inactive */
  43. #define RED_ACTIVE 0xD84156C5635688C0ULL /* when obj is active */
  44. #define SLUB_RED_INACTIVE 0xbb
  45. #define SLUB_RED_ACTIVE 0xcc
  46. /* ...and for poisoning */
  47. #define POISON_INUSE 0x5a /* for use-uninitialised poisoning */
  48. #define POISON_FREE 0x6b /* for use-after-free poisoning */
  49. #define POISON_END 0xa5 /* end-byte of poisoning */
  50. /********** arch/$ARCH/mm/init.c **********/
  51. #define POISON_FREE_INITMEM 0xcc
  52. /********** arch/ia64/hp/common/sba_iommu.c **********/
  53. /*
  54. * arch/ia64/hp/common/sba_iommu.c uses a 16-byte poison string with a
  55. * value of "SBAIOMMU POISON\0" for spill-over poisoning.
  56. */
  57. /********** fs/jbd/journal.c **********/
  58. #define JBD_POISON_FREE 0x5b
  59. #define JBD2_POISON_FREE 0x5c
  60. /********** drivers/base/dmapool.c **********/
  61. #define POOL_POISON_FREED 0xa7 /* !inuse */
  62. #define POOL_POISON_ALLOCATED 0xa9 /* !initted */
  63. /********** drivers/atm/ **********/
  64. #define ATM_POISON_FREE 0x12
  65. #define ATM_POISON 0xdeadbeef
  66. /********** kernel/mutexes **********/
  67. #define MUTEX_DEBUG_INIT 0x11
  68. #define MUTEX_DEBUG_FREE 0x22
  69. /********** security/ **********/
  70. #define KEY_DESTROY 0xbd
  71. #endif