Ticket #6312: slab-ReturnObjectToSlab-protect-from-wrong-freed-object-v2.patch

src/system/kernel/slab/ObjectCache.cpp

@@ -203 +203 @@
 
     ParanoiaChecker _(source);
 
+#if KDEBUG >= 1
+    uint8* objectsStart = (uint8*)source->pages + source->offset;
+    if (object < objectsStart
+        || object >= objectsStart + source->size * object_size) {
+        panic("object_cache: free'd object does not belong to this slab");
+        return;
+    }
+
+    if (((uint8*)object - objectsStart) % object_size != 0) {
+        panic("object_cache: returning a wrong pointer to a slab object");
+        return;
+    }
+#endif // KDEBUG
+
     object_link* link = object_to_link(object, object_size);
 
     TRACE_CACHE(this, "returning %p (%p) to %p, %lu used (%lu empty slabs).",