://bugzilla.kernel.org/show_bug.cgi?id=210221
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
---
arch/arm64/kernel/sleep.S| 2 +-
arch/x86/kernel/acpi/wakeup_64.S | 2 +-
include
and default value y, and for clang prompt and default value n.
[1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
---
v2: make commit
On Thu, 2021-01-07 at 14:00 -0700, Nathan Chancellor wrote:
> On Thu, Jan 07, 2021 at 02:21:52PM +0800, Walter Wu wrote:
> > CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN
> > stack instrumentation, but we should only need one config option,
> &
=%22use-after-free%22%20expire_timers
[3]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (5):
timer: kasan: record and print timer stack
workqueue: kasan: record and print workqueue stack
lib/test_kasan.c: add timer test case
lib/test_kasan.c: add workqueue test case
kasan: update
callback, we store
this call stack in order to print it in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Thomas Gleixner
Cc: John Stultz
Cc: Stephen Boyd
Cc: Andrew Morton
---
include/linux/kasan.h | 2 ++
kernel/time/timer.c
stack in order to print it in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Tejun Heo
Cc: Lai Jiangshan
Cc: Andrew Morton
---
include/linux/kasan.h | 2 ++
kernel/workqueue.c| 3 +++
mm/kasan/generic.c| 21
+0x20/0x40
__kasan_slab_free+0x10c/0x170
kasan_slab_free+0x10/0x18
kfree+0x98/0x270
kasan_timer_function+0x1c/0x28
Last timer stack:
kasan_save_stack+0x24/0x50
kasan_record_tmr_stack+0xa8/0xb8
init_timer_key+0xf0/0x248
kasan_timer_uaf+0x5c/0xd8
Signed-off-by: Walter Wu
Cc: Andrey
kasan_workqueue_uaf+0xfc/0x190
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
lib/test_kasan.c | 30 ++
1 file changed, 30 insertions(+)
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index
Generic KASAN support to record the last two timer and workqueue
stacks and print them in KASAN report. So that need to update
documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 4
On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote:
>
> > On Aug 10, 2020, at 3:21 AM, Walter Wu wrote:
> >
> > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2].
> > In some of these access/allocation happened in process_one_work(),
> >
On Mon, 2020-08-10 at 19:50 +0800, Walter Wu wrote:
> On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote:
> >
> > > On Aug 10, 2020, at 3:21 AM, Walter Wu wrote:
> > >
> > > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2].
> > >
On Mon, 2020-08-10 at 08:44 -0400, Qian Cai wrote:
> On Mon, Aug 10, 2020 at 07:50:57PM +0800, Walter Wu wrote:
> > On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote:
> > >
> > > > On Aug 10, 2020, at 3:21 AM, Walter Wu
> > > > wrote:
> &
On Wed, 2020-08-12 at 16:13 +0200, Marco Elver wrote:
> On Mon, 10 Aug 2020 at 09:23, Walter Wu wrote:
> > This patch records the last two timer queueing stacks and prints
> > up to 2 timer stacks in KASAN report. It is useful for programmers
> > to solve use-after-free
On Thu, 2020-08-13 at 13:48 +0200, Thomas Gleixner wrote:
> Walter,
>
> Walter Wu writes:
> > This patch records the last two timer queueing stacks and prints
>
> "This patch" is useless information as we already know from the subject
> line that this is
Hi Thomas,
Please ignore my previous mail. Thanks.
On Thu, 2020-08-13 at 13:48 +0200, Thomas Gleixner wrote:
> Walter,
>
> Walter Wu writes:
> > This patch records the last two timer queueing stacks and prints
>
> "This patch" is useless information as we alrea
for generic KASAN.
[1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work
[2]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22%20expire_timers
[3]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (6):
timer: kasan: record timer
cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Suggested-by: Thomas Gleixner
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: John Stultz
Cc: Thomas Gleixner
Cc: Stephen Boyd
---
v2:
- Thanks for Marco and Thomas suggestion.
- Remove unnecessary code and fix
report to determine
whether it is root cause. They don't need to enable debugobjects,
but they have a chance to find out the root cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Tejun Heo
Cc: Lai Jiangshan
---
v2
The aux_stack[2] is reused to record the call_rcu() call stack,
timer init call stack, and enqueuing work call stacks. So that
we need to change the auxiliary stack title for common title,
print them in KASAN report.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Cc: Andrey Ryabinin
Cc
__kasan_slab_free+0x10c/0x170
kasan_slab_free+0x10/0x18
kfree+0x98/0x270
kasan_timer_function+0x1c/0x28
Last potentially related work creation:
kasan_save_stack+0x24/0x50
kasan_record_tmr_stack+0xa8/0xb8
init_timer_key+0xf0/0x248
kasan_timer_uaf+0x5c/0xd8
Signed-off-by: Walter Wu
Cc: Andrey
Generic KASAN support to record the last two timer and workqueue
stacks and print them in KASAN report. So that need to update
documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 4
kasan_workqueue_uaf+0xfc/0x190
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
Cc: Andrey Konovalov
---
lib/test_kasan.c | 29 +
1 file changed, 29 insertions(+)
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
at 10:26 AM 'Marco Elver' via kasan-dev
> > wrote:
> > >
> > > On Tue, 25 Aug 2020 at 03:57, Walter Wu
> wrote:
> > > >
> > > > Syzbot reports many UAF issues for workqueue or timer,
>
On Sun, 2020-12-27 at 20:51 +0100, Dmitry Vyukov wrote:
> /\/\/\/\On Sun, Dec 27, 2020 at 8:45 PM Andrew Morton
> wrote:
> >
> > (cc KASAN developers)
> >
> > On Sat, 26 Dec 2020 15:25:14 -0800 syzbot
> > wrote:
> >
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD
dereference.
[1] https://syzkaller.appspot.com/x/log.txt?x=10a82a50d0
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
CC: Dmitry Vyukov
CC: Andrey Konovalov
Cc: Alexander Potapenko
Cc: Andrew Morton
---
mm/kasan/generic.c | 2 ++
1 file changed, 2 insertions(+)
diff
On Thu, 2020-12-03 at 11:29 +0100, Marco Elver wrote:
> On Thu, 3 Dec 2020 at 03:27, Walter Wu wrote:
> >
> > Adds a test to verify workqueue stack recording and print it in
> > KASAN report.
> >
> > The KASAN report was as follows(cleaned up slightly):
&g
Hi Dmitry,
On Tue, 2020-12-01 at 08:59 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> On Wed, Sep 30, 2020 at 5:29 PM Thomas Gleixner wrote:
> >
> > On Thu, Sep 24 2020 at 12:01, Walter Wu wrote:
> > > Syzbot reports many UAF issues for workqueue or timer, see [1
On Tue, 2020-12-01 at 15:02 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> On Tue, Dec 1, 2020 at 12:17 PM Walter Wu wrote:
> >
> > Hi Dmitry,
> >
> > On Tue, 2020-12-01 at 08:59 +0100, 'Dmitry Vyukov' via kasan-dev wrote:
> > > On Wed, Sep 30, 2020 at 5
-after-free%22+process_one_work
[2]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (4):
workqueue: kasan: record workqueue stack
kasan: print workqueue stack
lib/test_kasan.c: add workqueue test case
kasan: update documentation for generic kasan
---
Changes since v4:
- Not found timer
report to determine
whether it is root cause. They don't need to enable debugobjects,
but they have a chance to find out the root cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Acked-by: Tejun Heo
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey
kasan_workqueue_uaf+0xfc/0x190
Signed-off-by: Walter Wu
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
v4:
- testcase has merge conflict, so that rebase onto the KASAN-KUNIT
---
lib
The aux_stack[2] is reused to record the call_rcu() call stack
and enqueuing work call stacks. So that we need to change the
auxiliary stack title for common title, print them in KASAN report.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Generic KASAN also supports to record the last two workqueue
stacks and print them in KASAN report. So that need to update
documentation.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc
> > const char *get_bug_type(struct kasan_access_info *info)
> > {
> > +#ifdef CONFIG_KASAN_SW_TAGS_IDENTIFY
> > + struct kasan_alloc_meta *alloc_meta;
> > + struct kmem_cache *cache;
> > + struct page *page;
> > + const void *addr;
> > + void *object;
> > +
:
kasan_free_pages+0x68/0x70
__free_pages_ok+0x3c0/0x1328
__free_pages+0x50/0x78
kfree+0x1c4/0x250
kmalloc_pagealloc_uaf+0x38/0x80
This has been discussed, please refer below link.
https://bugzilla.kernel.org/show_bug.cgi?id=203967
Signed-off-by: Walter Wu
---
lib/Kconfig.kasan | 9 +
mm/kasan
When enable CONFIG_KASAN_DUMP_PAGE, then page_owner will record last stack,
So we need to know the last stack is allocation or free state.
Signed-off-by: Walter Wu
---
mm/page_owner.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/mm/page_owner.c b/mm/page_owner.c
index addcbb2ae4e4
On Wed, 2019-09-04 at 14:49 +0200, Vlastimil Babka wrote:
> On 9/4/19 8:51 AM, Walter Wu wrote:
> > This patch is KASAN report adds the alloc/free stacks for page allocator
> > in order to help programmer to see memory corruption caused by page.
> >
> > By default, KASA
On Wed, 2019-09-04 at 15:44 +0200, Andrey Konovalov wrote:
> On Wed, Sep 4, 2019 at 8:51 AM Walter Wu wrote:
> > +config KASAN_DUMP_PAGE
> > + bool "Dump the page last stack information"
> > + depends on KASAN && PAGE_OWNER
> > +
On Wed, 2019-09-04 at 16:13 +0200, Vlastimil Babka wrote:
> On 9/4/19 4:06 PM, Walter Wu wrote:
> > On Wed, 2019-09-04 at 14:49 +0200, Vlastimil Babka wrote:
> >> On 9/4/19 8:51 AM, Walter Wu wrote:
> >> > This patch is KASAN report adds the alloc/free stacks for
dma_buf_map_attachment+0x4c/0x80
disp_sync_prepare_buf+0x378/0x820
_ioctl_prepare_buffer+0x130/0x870
mtk_disp_mgr_ioctl+0x5c4/0xab0
do_vfs_ioctl+0x8e0/0x15a4
__arm64_sys_ioctl+0x8c/0xb4
el0_svc_common+0xe4/0x1e0
el0_svc_handler+0x30/0x3c
el0_svc+0x8/0xc
Signed-off-by: Walter Wu
---
arch
On Mon, 2019-08-19 at 17:06 +0300, Andrey Ryabinin wrote:
>
> On 8/19/19 4:34 PM, Will Deacon wrote:
> > On Mon, Aug 19, 2019 at 02:23:48PM +0100, Mark Rutland wrote:
> >> On Mon, Aug 19, 2019 at 01:56:26PM +0100, Will Deacon wrote:
> >>> On Mon, Aug 19, 2019 at
On Tue, 2019-08-06 at 13:43 +0800, Walter Wu wrote:
> This patch adds memory corruption identification at bug report for
> software tag-based mode, the report show whether it is "use-after-free"
> or "out-of-bound" error instead of "invalid-access" error. Thi
On Mon, 2019-07-08 at 19:33 +0300, Andrey Ryabinin wrote:
>
> On 7/5/19 4:34 PM, Dmitry Vyukov wrote:
> > On Mon, Jul 1, 2019 at 11:56 AM Walter Wu wrote:
> >>>>>>>>> This patch adds memory corruption identification at bug report for
> >>>&
qobject_free()
- fix the duplicating function name 3 times in the header.
- modify the function name set_track() to kasan_set_track()
Cc: Dmitry Vyukov
Signed-off-by: Walter Wu
---
lib/Kconfig.kasan | 8 +++
mm/kasan/Makefile | 1 +
mm/kasan/common.c | 9 +-
On Thu, 2019-06-13 at 15:27 +0300, Andrey Ryabinin wrote:
>
> On 6/13/19 11:13 AM, Walter Wu wrote:
> > This patch adds memory corruption identification at bug report for
> > software tag-based mode, the report show whether it is "use-after-free"
> > or "
On Fri, 2019-06-14 at 01:46 +0800, Walter Wu wrote:
> On Thu, 2019-06-13 at 15:27 +0300, Andrey Ryabinin wrote:
> >
> > On 6/13/19 11:13 AM, Walter Wu wrote:
> > > This patch adds memory corruption identification at bug report for
> > > software tag-based mode, t
for generic KASAN.
[1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work
[2]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22%20expire_timers
[3]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (6):
timer: kasan: record timer
cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Suggested-by: Thomas Gleixner
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: John Stultz
Cc: Thomas Gleixner
Cc: Stephen Boyd
---
v2:
- Thanks for Marco and Thomas suggestion.
- Remove unnecessary code and fix
report to determine
whether it is root cause. They don't need to enable debugobjects,
but they have a chance to find out the root cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Tejun Heo
Cc: Lai Jiangshan
---
v2
The aux_stack[2] is reused to record the call_rcu() call stack,
timer init call stack, and enqueuing work call stacks. So that
we need to change the auxiliary stack title for common title,
print them in KASAN report.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Cc: Andrey Ryabinin
Cc
__kasan_slab_free+0x10c/0x170
kasan_slab_free+0x10/0x18
kfree+0x98/0x270
kasan_timer_function+0x1c/0x28
Last potentially related work creation:
kasan_save_stack+0x24/0x50
kasan_record_tmr_stack+0xa8/0xb8
init_timer_key+0xf0/0x248
kasan_timer_uaf+0x5c/0xd8
Signed-off-by: Walter Wu
Cc: Andrey
kasan_workqueue_uaf+0xfc/0x190
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
Cc: Andrey Konovalov
---
lib/test_kasan.c | 29 +
1 file changed, 29 insertions(+)
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
Generic KASAN also supports to record the last two timer and workqueue
stacks and print them in KASAN report. So that need to update
documentation.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
v3
On Mon, 2020-08-24 at 13:50 +0200, Marco Elver wrote:
> On Mon, 24 Aug 2020 at 10:07, Walter Wu wrote:
> >
> > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2].
> > In some of these access/allocation happened in process_one_work(),
> > we se
for generic KASAN.
[1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work
[2]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22%20expire_timers
[3]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Walter Wu (6):
timer: kasan: record timer
__kasan_slab_free+0x10c/0x170
kasan_slab_free+0x10/0x18
kfree+0x98/0x270
kasan_timer_function+0x1c/0x28
Last potentially related work creation:
kasan_save_stack+0x24/0x50
kasan_record_tmr_stack+0xa8/0xb8
init_timer_key+0xf0/0x248
kasan_timer_uaf+0x5c/0xd8
Signed-off-by: Walter Wu
Acked
kasan_workqueue_uaf+0xfc/0x190
Signed-off-by: Walter Wu
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
v4:
- testcase has merge conflict, so that rebase onto the KASAN-KUNIT
---
lib
cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Suggested-by: Thomas Gleixner
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: John Stultz
Cc: Thomas Gleixner
Cc: Stephen Boyd
---
v2:
- Thanks for Marco
report to determine
whether it is root cause. They don't need to enable debugobjects,
but they have a chance to find out the root cause.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Acked-by: Tejun Heo
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc
The aux_stack[2] is reused to record the call_rcu() call stack,
timer init call stack, and enqueuing work call stacks. So that
we need to change the auxiliary stack title for common title,
print them in KASAN report.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Generic KASAN also supports to record the last two timer and workqueue
stacks and print them in KASAN report. So that need to update
documentation.
Signed-off-by: Walter Wu
Suggested-by: Marco Elver
Acked-by: Marco Elver
Reviewed-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey
On Thu, 2020-09-24 at 13:51 +0200, 'Alexander Potapenko' via kasan-dev
wrote:
> > ---
> > Documentation/dev-tools/kasan.rst | 5 +++--
> > kernel/time/timer.c | 3 +++
> > kernel/workqueue.c| 3 +++
> > lib/test_kasan_module.c | 55
> >
On Thu, 2020-09-24 at 23:41 +0200, Thomas Gleixner wrote:
> On Thu, Sep 24 2020 at 12:03, Walter Wu wrote:
> > When analyze use-after-free or double-free issue, recording the timer
> > stacks is helpful to preserve usage history which potentially gives
> > a hint ab
On Fri, 2020-09-25 at 10:55 +0200, Thomas Gleixner wrote:
> Walter,
>
> On Fri, Sep 25 2020 at 15:18, Walter Wu wrote:
> > On Thu, 2020-09-24 at 23:41 +0200, Thomas Gleixner wrote:
> >> > For timers it has turned out to be useful to record the stack trace
&g
Hi Thomas,
On Sat, 2020-09-26 at 00:59 +0200, Thomas Gleixner wrote:
> On Fri, Sep 25 2020 at 17:15, Walter Wu wrote:
> > On Fri, 2020-09-25 at 10:55 +0200, Thomas Gleixner wrote:
> >> > We don't want to replace DEBUG_OBJECTS_TIMERS with this patches, only
> >> >
-by: Walter Wu
---
mm/page_ext.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/page_ext.c b/mm/page_ext.c
index 5f5769c7db3b..7ca33dcd9ffa 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -65,6 +65,9 @@ static struct page_ext_operations *page_ext_ops[] = {
#if defined
On Mon, 2019-09-09 at 12:57 +0200, David Hildenbrand wrote:
> On 09.09.19 10:53, Walter Wu wrote:
> > KASAN will record last stack of page in order to help programmer
> > to see memory corruption caused by page.
> >
> > What is difference between page_owner and our pa
On Tue, 2019-09-10 at 12:31 +0300, Kirill A. Shutemov wrote:
> On Tue, Sep 10, 2019 at 09:07:49AM +0800, Walter Wu wrote:
> > On Mon, 2019-09-09 at 12:57 +0200, David Hildenbrand wrote:
> > > On 09.09.19 10:53, Walter Wu wrote:
> > > > KASAN will record last
On Mon, 2019-09-09 at 16:24 +0800, walter-zh...@mediatek.com wrote:
> From: Walter Wu
>
> This patch is KASAN report adds the alloc/free stacks for page allocator
> in order to help programmer to see memory corruption caused by page.
>
> By default, KASAN doesn't record al
On Tue, 2019-09-10 at 13:53 +0200, Vlastimil Babka wrote:
> On 9/10/19 12:50 PM, Andrey Ryabinin wrote:
> >
> >
> > For slab objects we memorize both alloc and free stacks. You'll never know
> > in advance what information will be usefull
> > to fix an issue, so it usually better to provide
On Tue, 2019-09-10 at 13:50 +0300, Andrey Ryabinin wrote:
>
> On 9/9/19 4:07 PM, Vlastimil Babka wrote:
> > On 9/9/19 10:24 AM, walter-zh...@mediatek.com wrote:
> >> From: Walter Wu
> >>
> >> This patch is KASAN report adds the alloc/free stacks f
kmalloc_pagealloc_uaf+0x38/0x80
Changes since v1:
- slim page_owner and move it into kasan
- enable the feature by default
Changes since v2:
- enable PAGE_OWNER by default
- use DEBUG_PAGEALLOC to get page information
cc: Andrey Ryabinin
cc: Vlastimil Babka
cc: Andrey Konovalov
Signed-off-by: Walter Wu
Konovalov
Signed-off-by: Walter Wu
---
lib/Kconfig.kasan | 15 +++
1 file changed, 15 insertions(+)
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index 4fafba1a923b..a3683e952b10 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -41,6 +41,7 @@ config KASAN_GENERIC
on object slot creation
- modify documentation
Changes since v4:
- change variable name to be more clearly
- remove the redundant condition
- remove init free meta-data and increasing object condition
Walter Wu (4):
rcu/kasan: record and print call_rcu() call stack
kasan: record and print the free
/show_bug.cgi?id=198437
[2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Andrew Morton
Cc: Paul
and kasan_free_meta:
- remove free track from kasan_alloc_meta.
- add free track into kasan_free_meta.
[1]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
---
mm/kasan/common.c
Test call_rcu() call stack recording and verify whether it correctly
is printed in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
lib/test_kasan.c | 30 ++
1 file changed, 30
Generic KASAN will support to record the last two call_rcu() call
stacks and print them in KASAN report. So need to update documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 3
Hi Andrey,
On Tue, 2020-05-19 at 16:52 +0200, 'Andrey Konovalov' via kasan-dev
wrote:
> On Tue, May 19, 2020 at 4:24 AM Walter Wu wrote:
> >
> > This feature will record the last two call_rcu() call stacks and
> > prints up to 2 call_rcu() call stacks in KASAN report.
On Tue, 2020-05-19 at 08:48 -0700, Paul E. McKenney wrote:
> On Tue, May 19, 2020 at 10:23:59AM +0800, Walter Wu wrote:
> > This feature will record the last two call_rcu() call stacks and
> > prints up to 2 call_rcu() call stacks in KASAN report.
> >
> > When cal
> On Tue, May 19, 2020 at 4:25 AM Walter Wu wrote:
> >
> > Move free track from slub alloc meta-data to slub free meta-data in
> > order to make struct kasan_free_meta size is 16 bytes. It is a good
> > size because it is the minimal redzone size and a g
> On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote:
> >
> > > On Tue, May 19, 2020 at 4:25 AM Walter Wu
> > > wrote:
> > > >
> > > > Move free track from slub alloc meta-data to slub free meta-data in
> > > > order to make str
> On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote:
> >
> > > On Tue, May 19, 2020 at 4:25 AM Walter Wu
> > > wrote:
> > > >
> > > > Move free track from slub alloc meta-data to slub free meta-data in
> > > > order to make str
On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote:
> > On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote:
> > >
> > > > On Tue, May 19, 2020 at 4:25 AM Walter Wu
> > > > wrote:
> > > > >
> > > > > Move free track from slub all
> On Wed, May 20, 2020 at 8:18 AM Walter Wu wrote:
> >
> > On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote:
> > > > On Wed, May 20, 2020 at 6:03 AM Walter Wu
> > > > wrote:
> > > > >
> > > > > > On Tue, May 19, 2020 at
On Wed, 2020-05-20 at 11:44 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
> On Wed, May 20, 2020 at 11:17 AM Walter Wu wrote:
> > > > On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote:
> > > > > > On Wed, May 20, 2020 at 6:03 AM Walter Wu
> > > > >
On Wed, 2020-05-20 at 13:15 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
> On Wed, May 20, 2020 at 12:15 PM Walter Wu wrote:
> >
> > On Wed, 2020-05-20 at 11:44 +0200, 'Dmitry Vyukov' via kasan-dev wrote:
> > > On Wed, May 20, 2020 at 11:17 AM Walter Wu
> > > w
- change printing message
- remove descriptions in Kocong.kasan
Walter Wu (4):
rcu/kasan: record and print call_rcu() call stack
kasan: record and print the free track
kasan: add tests for call_rcu stack recording
kasan: update documentation for generic kasan
Documentation/dev-tools/kasan.rst | 3
/show_bug.cgi?id=198437
[2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Acked-by: Paul E. McKenney
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
) Remove the free_track from struct kasan_alloc_meta.
2) Add the free_track into struct kasan_free_meta.
3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether
print free stack in KASAN report.
[1]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Signed-off-by: Walter Wu
Suggested
Test call_rcu() call stack recording and verify whether it correctly
is printed in KASAN report.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
lib/test_kasan.c | 30 ++
1 file changed, 30
Generic KASAN will support to record the last two call_rcu() call stacks
and print them in KASAN report. So that need to update documentation.
Signed-off-by: Walter Wu
Cc: Andrey Ryabinin
Cc: Dmitry Vyukov
Cc: Alexander Potapenko
Cc: Jonathan Corbet
---
Documentation/dev-tools/kasan.rst | 3
On Mon, 2020-05-25 at 11:56 +0200, Dmitry Vyukov wrote:
> On Fri, May 22, 2020 at 4:01 AM Walter Wu wrote:
> >
> > This feature will record the last two call_rcu() call stacks and
> > prints up to 2 call_rcu() call stacks in KASAN report.
> >
> > When call_rcu()
/show_bug.cgi?id=198437
[2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ
Signed-off-by: Walter Wu
Suggested-by: Dmitry Vyukov
Acked-by: Paul E. McKenney
Reviewed-and-tested-by: Dmitry Vyukov
Reviewed-by: Andrey
printing message
- remove descriptions in Kocong.kasan
Changes since v5:
- reuse print_stack() in print_track()
Changes since v6:
- fix typo
- renamed the variable name in testcase
Walter Wu (4):
rcu: kasan: record and print call_rcu() call stack
kasan: record and print the free track
kasan: add tests
Test call_rcu() call stack recording and verify whether it correctly
is printed in KASAN report.
Signed-off-by: Walter Wu
Reviewed-and-tested-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: Matthias Brugger
---
Changes since v6:
- renamed
) Remove the free_track from struct kasan_alloc_meta.
2) Add the free_track into struct kasan_free_meta.
3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether
it can print free stack in KASAN report.
[1]https://bugzilla.kernel.org/show_bug.cgi?id=198437
Signed-off-by: Walter Wu
Suggested
Generic KASAN will support to record the last two call_rcu() call stacks
and print them in KASAN report. So that need to update documentation.
Signed-off-by: Walter Wu
Reviewed-and-tested-by: Dmitry Vyukov
Reviewed-by: Andrey Konovalov
Cc: Andrey Ryabinin
Cc: Alexander Potapenko
Cc: Jonathan
On Wed, 2019-07-10 at 21:24 +0300, Andrey Ryabinin wrote:
>
> On 7/9/19 5:53 AM, Walter Wu wrote:
> > On Mon, 2019-07-08 at 19:33 +0300, Andrey Ryabinin wrote:
> >>
> >> On 7/5/19 4:34 PM, Dmitry Vyukov wrote:
> >>> On Mon, Jul 1, 2019 at 11:56 AM Wal
On Fri, 2019-07-12 at 13:52 +0300, Andrey Ryabinin wrote:
>
> On 7/11/19 1:06 PM, Walter Wu wrote:
> > On Wed, 2019-07-10 at 21:24 +0300, Andrey Ryabinin wrote:
> >>
> >> On 7/9/19 5:53 AM, Walter Wu wrote:
> >>> On Mon, 2019-07-08 at 19:33 +0300, Andrey
1 - 100 of 209 matches
Mail list logo
