KASAN uses stackdepot to memorize stacks for all kmalloc/kfree calls.
Current stackdepot capacity is 16MB (1024 top level entries x
4 pages on second level). Size of each stack is (num_frames + 3) *
sizeof(long). Which gives us ~84K stacks. This capacity was chosen
empirically and it is enough to run kernel normally. However,
when lots of configs are enabled and a fuzzer tries to maximize
code coverage, it easily hits the limit within tens of minutes.
I've tested for long a time with number of top level entries bumped 4x
(4096). And I think I've seen overflow only once. But I don't have
all configs enabled and code coverage has not reached maximum yet.
So bump it 8x to 8192. Since we have two-level table, memory cost
of this is very moderate -- currently the top-level table is 8KB,
with this patch it is 64KB, which is negligible under KASAN.

Here is some approx math.
128MB allows us to memorize ~670K stacks (assuming stack is ~200b).
I've grepped kernel for kmalloc|kfree|kmem_cache_alloc|kmem_cache_free|
kzalloc|kstrdup|kstrndup|kmemdup and it gives ~60K matches.
Most of alloc/free call sites are reachable with only one stack.
But some utility functions can have large fanout. Assuming average
fanout is 5x, total number of alloc/free stacks is ~300K.

Signed-off-by: Dmitry Vyukov <dvyu...@google.com>
Cc: kasan-...@googlegroups.com
Cc: Andrey Ryabinin <aryabi...@virtuozzo.com>
Cc: Alexander Potapenko <gli...@google.com>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: Joonsoo Kim <iamjoonsoo....@lge.com>
Cc: splovi...@gmail.com
Cc: linux...@kvack.org
Cc: linux-kernel@vger.kernel.org
 lib/stackdepot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index 60f77f1..4d830e2 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -50,7 +50,7 @@

Reply via email to