lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Tue, 19 May 2020 10:23:22 +0800
From:   Walter Wu <>
To:     Andrey Ryabinin <>,
        Alexander Potapenko <>,
        Dmitry Vyukov <>,
        Matthias Brugger <>,
        "Paul E . McKenney" <>,
        Josh Triplett <>,
        Mathieu Desnoyers <>,
        Lai Jiangshan <>,
        Joel Fernandes <>,
        Andrew Morton <>
CC:     <>, <>,
        wsd_upstream <>,
        Walter Wu <>
Subject: [PATCH v4 0/4] kasan: memorize and print call_rcu stack

This patchset improves KASAN reports by making them to have
call_rcu() call stack information. It is useful for programmers
to solve use-after-free or double-free memory issue.

The KASAN report was as follows(cleaned up slightly):

BUG: KASAN: use-after-free in kasan_rcu_reclaim+0x58/0x60

Freed by task 0:

Last one call_rcu() call stack:

Generic KASAN will record the last two call_rcu() call stacks and
print up to 2 call_rcu() call stacks in KASAN report. it is only
suitable for generic KASAN.

This feature considers the size of struct kasan_alloc_meta and
kasan_free_meta, we try to optimize the structure layout and size
, let it get better memory consumption.


Changes since v2:
- remove new config option, default enable it in generic KASAN
- test this feature in SLAB/SLUB, it is pass.
- modify macro to be more clearly
- modify documentation

Changes since v3:
- change recording from first/last to the last two call stacks
- move free track into kasan free meta
- init slab_free_meta on object slot creation
- modify documentation

Changes since v4:
- change variable name to be more clearly
- remove the redundant condition
- remove init free meta-data and increasing object condition

Walter Wu (4):
rcu/kasan: record and print call_rcu() call stack
kasan: record and print the free track
kasan: add tests for call_rcu stack recording
kasan: update documentation for generic kasan

Documentation/dev-tools/kasan.rst |  3 +++
include/linux/kasan.h             |  2 ++
kernel/rcu/tree.c                 |  2 ++
lib/Kconfig.kasan                 |  2 ++
lib/test_kasan.c                  | 30 ++++++++++++++++++++++++++++++
mm/kasan/common.c                 | 26 ++++----------------------
mm/kasan/generic.c                | 37 +++++++++++++++++++++++++++++++++++++
mm/kasan/kasan.h                  | 17 +++++++++++++++++
mm/kasan/report.c                 | 36 ++++++++++++++++++++----------------
mm/kasan/tags.c                   | 37 +++++++++++++++++++++++++++++++++++++
10 files changed, 154 insertions(+), 38 deletions(-)

Powered by blists - more mailing lists