[PATCH v2] task_work: kasan: record task_work_add() call stack

-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrew Morton Cc: Matthias Brugger Cc: Jens Axboe Cc: Oleg Nesterov --- v2: Fix kasan_record_aux_stack() calling sequence issue. Thanks for Dmitry's

Re: [PATCH] task_work: kasan: record task_work_add() call stack

On Mon, 2021-03-15 at 11:03 +0100, 'Dmitry Vyukov' via kasan-dev wrote: > On Mon, Mar 15, 2021 at 10:38 AM Walter Wu wrote: > > > > On Mon, 2021-03-15 at 07:58 +0100, 'Dmitry Vyukov' via kasan-dev wrote: > > > On Mon, Mar 15, 2021 at 3:00 AM Walter Wu > > >

Re: [PATCH] task_work: kasan: record task_work_add() call stack

On Mon, 2021-03-15 at 07:58 +0100, 'Dmitry Vyukov' via kasan-dev wrote: > On Mon, Mar 15, 2021 at 3:00 AM Walter Wu wrote: > > > > Why record task_work_add() call stack? > > Syzbot reports many use-after-free issues for task_work, see [1]. > > After see the free stac

[PATCH] task_work: kasan: record task_work_add() call stack

-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrew Morton Cc: Matthias Brugger Cc: Jens Axboe Cc: Oleg Nesterov --- kernel/task_work.c | 3 +++ mm/kasan/kasan.h | 2 +- 2 files changed, 4 insertions

Re: [PATCH v4] kasan: remove redundant config option

On Wed, 2021-03-03 at 19:48 +0800, Walter Wu wrote: > On Fri, 2021-02-26 at 09:25 +0800, Walter Wu wrote: > > CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN stack > > instrumentation, but we should only need one config, so that we remove > > CONFIG_KASAN_

Re: [PATCH v4] kasan: remove redundant config option

On Fri, 2021-02-26 at 09:25 +0800, Walter Wu wrote: > CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN stack > instrumentation, but we should only need one config, so that we remove > CONFIG_KASAN_STACK_ENABLE and make CONFIG_KASAN_STACK workable. see [1]. > > Wh

[PATCH v4] kasan: remove redundant config option

and default value y, and for clang prompt and default value n. [1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221 Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Reviewed-by: Nathan Chancellor Acked-by: Arnd Bergmann Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov

[PATCH v3] kasan: remove redundant config option

and default value y, and for clang prompt and default value n. [1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221 Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrew Morton Cc: Nathan Chancellor

Re: [PATCH] kasan: remove redundant config option

On Thu, 2021-01-07 at 14:00 -0700, Nathan Chancellor wrote: > On Thu, Jan 07, 2021 at 02:21:52PM +0800, Walter Wu wrote: > > CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN > > stack instrumentation, but we should only need one config option, > &

[PATCH v2] kasan: remove redundant config option

and default value y, and for clang prompt and default value n. [1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221 Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrew Morton --- v2: make commit

[PATCH] kasan: remove redundant config option

://bugzilla.kernel.org/show_bug.cgi?id=210221 Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrew Morton --- arch/arm64/kernel/sleep.S| 2 +- arch/x86/kernel/acpi/wakeup_64.S | 2 +- include

[PATCH] kasan: fix null pointer dereference in kasan_record_aux_stack

dereference. [1] https://syzkaller.appspot.com/x/log.txt?x=10a82a50d0 Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin CC: Dmitry Vyukov CC: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrew Morton --- mm/kasan/generic.c | 2 ++ 1 file changed, 2 insertions(+) diff

Re: BUG: unable to handle kernel NULL pointer dereference in call_rcu

On Sun, 2020-12-27 at 20:51 +0100, Dmitry Vyukov wrote: > /\/\/\/\On Sun, Dec 27, 2020 at 8:45 PM Andrew Morton > wrote: > > > > (cc KASAN developers) > > > > On Sat, 26 Dec 2020 15:25:14 -0800 syzbot > > wrote: > > > > > Hello, > > > > > > syzbot found the following issue on: > > > > > > HEAD

Re: [PATCH v5 3/4] lib/test_kasan.c: add workqueue test case

On Thu, 2020-12-03 at 11:29 +0100, Marco Elver wrote: > On Thu, 3 Dec 2020 at 03:27, Walter Wu wrote: > > > > Adds a test to verify workqueue stack recording and print it in > > KASAN report. > > > > The KASAN report was as follows(cleaned up slightly): &g

[PATCH v5 4/4] kasan: update documentation for generic kasan

Generic KASAN also supports to record the last two workqueue stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc

[PATCH v5 3/4] lib/test_kasan.c: add workqueue test case

kasan_workqueue_uaf+0xfc/0x190 Signed-off-by: Walter Wu Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Matthias Brugger --- v4: - testcase has merge conflict, so that rebase onto the KASAN-KUNIT --- lib

[PATCH v5 2/4] kasan: print workqueue stack

The aux_stack[2] is reused to record the call_rcu() call stack and enqueuing work call stacks. So that we need to change the auxiliary stack title for common title, print them in KASAN report. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov

[PATCH v5 1/4] workqueue: kasan: record workqueue stack

report to determine whether it is root cause. They don't need to enable debugobjects, but they have a chance to find out the root cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Acked-by: Tejun Heo Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey

[PATCH v5 0/4] kasan: add workqueue stack for generic KASAN

-after-free%22+process_one_work [2]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Walter Wu (4): workqueue: kasan: record workqueue stack kasan: print workqueue stack lib/test_kasan.c: add workqueue test case kasan: update documentation for generic kasan --- Changes since v4: - Not found timer

Re: [PATCH v4 0/6] kasan: add workqueue and timer stack for generic KASAN

On Tue, 2020-12-01 at 15:02 +0100, 'Dmitry Vyukov' via kasan-dev wrote: > On Tue, Dec 1, 2020 at 12:17 PM Walter Wu wrote: > > > > Hi Dmitry, > > > > On Tue, 2020-12-01 at 08:59 +0100, 'Dmitry Vyukov' via kasan-dev wrote: > > > On Wed, Sep 30, 2020 at 5

Re: [PATCH v4 0/6] kasan: add workqueue and timer stack for generic KASAN

Hi Dmitry, On Tue, 2020-12-01 at 08:59 +0100, 'Dmitry Vyukov' via kasan-dev wrote: > On Wed, Sep 30, 2020 at 5:29 PM Thomas Gleixner wrote: > > > > On Thu, Sep 24 2020 at 12:01, Walter Wu wrote: > > > Syzbot reports many UAF issues for workqueue or timer, see [1

Re: [PATCH v4 1/6] timer: kasan: record timer stack

Hi Thomas, On Sat, 2020-09-26 at 00:59 +0200, Thomas Gleixner wrote: > On Fri, Sep 25 2020 at 17:15, Walter Wu wrote: > > On Fri, 2020-09-25 at 10:55 +0200, Thomas Gleixner wrote: > >> > We don't want to replace DEBUG_OBJECTS_TIMERS with this patches, only > >> >

Re: [PATCH v4 1/6] timer: kasan: record timer stack

On Fri, 2020-09-25 at 10:55 +0200, Thomas Gleixner wrote: > Walter, > > On Fri, Sep 25 2020 at 15:18, Walter Wu wrote: > > On Thu, 2020-09-24 at 23:41 +0200, Thomas Gleixner wrote: > >> > For timers it has turned out to be useful to record the stack trace &g

Re: [PATCH v4 1/6] timer: kasan: record timer stack

On Thu, 2020-09-24 at 23:41 +0200, Thomas Gleixner wrote: > On Thu, Sep 24 2020 at 12:03, Walter Wu wrote: > > When analyze use-after-free or double-free issue, recording the timer > > stacks is helpful to preserve usage history which potentially gives > > a hint ab

Re: [PATCH v4 0/6] kasan: add workqueue and timer stack for generic KASAN

On Thu, 2020-09-24 at 13:51 +0200, 'Alexander Potapenko' via kasan-dev wrote: > > --- > > Documentation/dev-tools/kasan.rst | 5 +++-- > > kernel/time/timer.c | 3 +++ > > kernel/workqueue.c| 3 +++ > > lib/test_kasan_module.c | 55 > >

[PATCH v4 6/6] kasan: update documentation for generic kasan

Generic KASAN also supports to record the last two timer and workqueue stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey

[PATCH v4 3/6] kasan: print timer and workqueue stack

The aux_stack[2] is reused to record the call_rcu() call stack, timer init call stack, and enqueuing work call stacks. So that we need to change the auxiliary stack title for common title, print them in KASAN report. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver

[PATCH v4 2/6] workqueue: kasan: record workqueue stack

report to determine whether it is root cause. They don't need to enable debugobjects, but they have a chance to find out the root cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Acked-by: Marco Elver Acked-by: Tejun Heo Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc

[PATCH v4 1/6] timer: kasan: record timer stack

cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Suggested-by: Thomas Gleixner Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: John Stultz Cc: Thomas Gleixner Cc: Stephen Boyd --- v2: - Thanks for Marco

PATCH v4 5/6] kasan: add tests for workqueue stack recording

kasan_workqueue_uaf+0xfc/0x190 Signed-off-by: Walter Wu Acked-by: Marco Elver Reviewed-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Matthias Brugger --- v4: - testcase has merge conflict, so that rebase onto the KASAN-KUNIT --- lib

[PATCH v4 4/6] kasan: add tests for timer stack recording

__kasan_slab_free+0x10c/0x170 kasan_slab_free+0x10/0x18 kfree+0x98/0x270 kasan_timer_function+0x1c/0x28 Last potentially related work creation: kasan_save_stack+0x24/0x50 kasan_record_tmr_stack+0xa8/0xb8 init_timer_key+0xf0/0x248 kasan_timer_uaf+0x5c/0xd8 Signed-off-by: Walter Wu Acked

[PATCH v4 0/6] kasan: add workqueue and timer stack for generic KASAN

for generic KASAN. [1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work [2]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22%20expire_timers [3]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Walter Wu (6): timer: kasan: record timer

Re: [PATCH v3 0/6] kasan: add workqueue and timer stack for generic KASAN

at 10:26 AM 'Marco Elver' via kasan-dev > > wrote: > > > > > > On Tue, 25 Aug 2020 at 03:57, Walter Wu > wrote: > > > > > > > > Syzbot reports many UAF issues for workqueue or timer, >

Re: [PATCH v2 0/6] kasan: add workqueue and timer stack for generic KASAN

On Mon, 2020-08-24 at 13:50 +0200, Marco Elver wrote: > On Mon, 24 Aug 2020 at 10:07, Walter Wu wrote: > > > > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2]. > > In some of these access/allocation happened in process_one_work(), > > we se

[PATCH v3 6/6] kasan: update documentation for generic kasan

Generic KASAN also supports to record the last two timer and workqueue stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Suggested-by: Marco Elver Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jonathan Corbet --- v3

[PATCH v3 5/6] kasan: add tests for workqueue stack recording

kasan_workqueue_uaf+0xfc/0x190 Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger Cc: Andrey Konovalov --- lib/test_kasan.c | 29 + 1 file changed, 29 insertions(+) diff --git a/lib/test_kasan.c b/lib/test_kasan.c

[PATCH v3 4/6] kasan: add tests for timer stack recording

__kasan_slab_free+0x10c/0x170 kasan_slab_free+0x10/0x18 kfree+0x98/0x270 kasan_timer_function+0x1c/0x28 Last potentially related work creation: kasan_save_stack+0x24/0x50 kasan_record_tmr_stack+0xa8/0xb8 init_timer_key+0xf0/0x248 kasan_timer_uaf+0x5c/0xd8 Signed-off-by: Walter Wu Cc: Andrey

[PATCH v3 3/6] kasan: print timer and workqueue stack

The aux_stack[2] is reused to record the call_rcu() call stack, timer init call stack, and enqueuing work call stacks. So that we need to change the auxiliary stack title for common title, print them in KASAN report. Signed-off-by: Walter Wu Suggested-by: Marco Elver Cc: Andrey Ryabinin Cc

[PATCH v3 1/6] timer: kasan: record timer stack

cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Suggested-by: Thomas Gleixner Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: John Stultz Cc: Thomas Gleixner Cc: Stephen Boyd --- v2: - Thanks for Marco and Thomas suggestion. - Remove unnecessary code and fix

[PATCH v3 2/6] workqueue: kasan: record workqueue stack

report to determine whether it is root cause. They don't need to enable debugobjects, but they have a chance to find out the root cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Tejun Heo Cc: Lai Jiangshan --- v2

[PATCH v3 0/6] kasan: add workqueue and timer stack for generic KASAN

for generic KASAN. [1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work [2]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22%20expire_timers [3]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Walter Wu (6): timer: kasan: record timer

[PATCH v2 6/6] kasan: update documentation for generic kasan

Generic KASAN support to record the last two timer and workqueue stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jonathan Corbet --- Documentation/dev-tools/kasan.rst | 4

[PATCH v2 5/6] kasan: add tests for workqueue stack recording

kasan_workqueue_uaf+0xfc/0x190 Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger Cc: Andrey Konovalov --- lib/test_kasan.c | 29 + 1 file changed, 29 insertions(+) diff --git a/lib/test_kasan.c b/lib/test_kasan.c

[PATCH v2 4/6] kasan: add tests for timer stack recording

__kasan_slab_free+0x10c/0x170 kasan_slab_free+0x10/0x18 kfree+0x98/0x270 kasan_timer_function+0x1c/0x28 Last potentially related work creation: kasan_save_stack+0x24/0x50 kasan_record_tmr_stack+0xa8/0xb8 init_timer_key+0xf0/0x248 kasan_timer_uaf+0x5c/0xd8 Signed-off-by: Walter Wu Cc: Andrey

[PATCH v2 3/6] kasan: print timer and workqueue stack

The aux_stack[2] is reused to record the call_rcu() call stack, timer init call stack, and enqueuing work call stacks. So that we need to change the auxiliary stack title for common title, print them in KASAN report. Signed-off-by: Walter Wu Suggested-by: Marco Elver Cc: Andrey Ryabinin Cc

[PATCH v2 2/6] workqueue: kasan: record workqueue stack

report to determine whether it is root cause. They don't need to enable debugobjects, but they have a chance to find out the root cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Tejun Heo Cc: Lai Jiangshan --- v2

[PATCH v2 1/6] timer: kasan: record timer stack

cause. Signed-off-by: Walter Wu Suggested-by: Marco Elver Suggested-by: Thomas Gleixner Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: John Stultz Cc: Thomas Gleixner Cc: Stephen Boyd --- v2: - Thanks for Marco and Thomas suggestion. - Remove unnecessary code and fix

[PATCH v2 0/6] kasan: add workqueue and timer stack for generic KASAN

for generic KASAN. [1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work [2]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22%20expire_timers [3]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Walter Wu (6): timer: kasan: record timer

Re: [PATCH 1/5] timer: kasan: record and print timer stack

Hi Thomas, Please ignore my previous mail. Thanks. On Thu, 2020-08-13 at 13:48 +0200, Thomas Gleixner wrote: > Walter, > > Walter Wu writes: > > This patch records the last two timer queueing stacks and prints > > "This patch" is useless information as we alrea

Re: [PATCH 1/5] timer: kasan: record and print timer stack

On Thu, 2020-08-13 at 13:48 +0200, Thomas Gleixner wrote: > Walter, > > Walter Wu writes: > > This patch records the last two timer queueing stacks and prints > > "This patch" is useless information as we already know from the subject > line that this is

Re: [PATCH 1/5] timer: kasan: record and print timer stack

On Wed, 2020-08-12 at 16:13 +0200, Marco Elver wrote: > On Mon, 10 Aug 2020 at 09:23, Walter Wu wrote: > > This patch records the last two timer queueing stacks and prints > > up to 2 timer stacks in KASAN report. It is useful for programmers > > to solve use-after-free

Re: [PATCH 0/5] kasan: add workqueue and timer stack for generic KASAN

On Mon, 2020-08-10 at 08:44 -0400, Qian Cai wrote: > On Mon, Aug 10, 2020 at 07:50:57PM +0800, Walter Wu wrote: > > On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote: > > > > > > > On Aug 10, 2020, at 3:21 AM, Walter Wu > > > > wrote: > &

Re: [PATCH 0/5] kasan: add workqueue and timer stack for generic KASAN

On Mon, 2020-08-10 at 19:50 +0800, Walter Wu wrote: > On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote: > > > > > On Aug 10, 2020, at 3:21 AM, Walter Wu wrote: > > > > > > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2]. > > >

Re: [PATCH 0/5] kasan: add workqueue and timer stack for generic KASAN

On Mon, 2020-08-10 at 07:19 -0400, Qian Cai wrote: > > > On Aug 10, 2020, at 3:21 AM, Walter Wu wrote: > > > > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2]. > > In some of these access/allocation happened in process_one_work(), > >

[PATCH 5/5] kasan: update documentation for generic KASAN

Generic KASAN support to record the last two timer and workqueue stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jonathan Corbet --- Documentation/dev-tools/kasan.rst | 4

[PATCH 4/5] lib/test_kasan.c: add workqueue test case

kasan_workqueue_uaf+0xfc/0x190 Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger --- lib/test_kasan.c | 30 ++ 1 file changed, 30 insertions(+) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index

[PATCH 3/5] lib/test_kasan.c: add timer test case

+0x20/0x40 __kasan_slab_free+0x10c/0x170 kasan_slab_free+0x10/0x18 kfree+0x98/0x270 kasan_timer_function+0x1c/0x28 Last timer stack: kasan_save_stack+0x24/0x50 kasan_record_tmr_stack+0xa8/0xb8 init_timer_key+0xf0/0x248 kasan_timer_uaf+0x5c/0xd8 Signed-off-by: Walter Wu Cc: Andrey

[PATCH 2/5] workqueue: kasan: record and print workqueue stack

stack in order to print it in KASAN report. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Tejun Heo Cc: Lai Jiangshan Cc: Andrew Morton --- include/linux/kasan.h | 2 ++ kernel/workqueue.c| 3 +++ mm/kasan/generic.c| 21

[PATCH 1/5] timer: kasan: record and print timer stack

callback, we store this call stack in order to print it in KASAN report. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Thomas Gleixner Cc: John Stultz Cc: Stephen Boyd Cc: Andrew Morton --- include/linux/kasan.h | 2 ++ kernel/time/timer.c

[PATCH 0/5] kasan: add workqueue and timer stack for generic KASAN

=%22use-after-free%22%20expire_timers [3]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Walter Wu (5): timer: kasan: record and print timer stack workqueue: kasan: record and print workqueue stack lib/test_kasan.c: add timer test case lib/test_kasan.c: add workqueue test case kasan: update

[PATCH v8 4/4] kasan: update documentation for generic kasan

Generic KASAN will support to record the last two call_rcu() call stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Reviewed-and-tested-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Jonathan

[PATCH v8 3/4] kasan: add tests for call_rcu stack recording

Test call_rcu() call stack recording and verify whether it correctly is printed in KASAN report. Signed-off-by: Walter Wu Reviewed-and-tested-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Matthias Brugger --- Changes since v6: - renamed

[PATCH v8 2/4] kasan: record and print the free track

) Remove the free_track from struct kasan_alloc_meta. 2) Add the free_track into struct kasan_free_meta. 3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether it can print free stack in KASAN report. [1]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Signed-off-by: Walter Wu Suggested

[PATCH v8 1/4] rcu: kasan: record and print call_rcu() call stack

/show_bug.cgi?id=198437 [2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Acked-by: Paul E. McKenney Reviewed-and-tested-by: Dmitry Vyukov Reviewed-by: Andrey

[PATCH v8 0/4] kasan: memorize and print call_rcu stack

printing message - remove descriptions in Kocong.kasan Changes since v5: - reuse print_stack() in print_track() Changes since v6: - fix typo - renamed the variable name in testcase Changes since v7: - fix this commit dependence in the series Walter Wu (4): rcu: kasan: record and print call_rcu() call

[PATCH v4] kasan: fix KASAN unit tests for tag-based KASAN

value is not equal to tag value of pointer, so that tag-based KASAN will detect out-of-bounds memory access. Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Acked-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Matthias Brugger Cc: Andrew

[PATCH v3] kasan: fix KASAN unit tests for tag-based KASAN

value is not equal to tag value of pointer, so that tag-based KASAN will detect out-of-bounds memory access. Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger Cc: Andrey Konovalov Cc: Andrew Morton

Re: [PATCH v2] kasan: fix KASAN unit tests for tag-based KASAN

On Mon, 2020-07-06 at 08:19 +0200, Dmitry Vyukov wrote: > On Mon, Jul 6, 2020 at 4:21 AM Walter Wu wrote: > > > > We use tag-based KASAN, then KASAN unit tests don't detect out-of-bounds > > memory access. They need to be fixed. > > > > With tag-based KASAN, t

[PATCH v2] kasan: fix KASAN unit tests for tag-based KASAN

value is not equal to tag value of pointer, so that tag-based KASAN will detect out-of-bounds memory access. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger Cc: Andrey Konovalov Cc: Andrew Morton --- changes since v1: - Reduce

Re: [PATCH v7 0/4] kasan: memorize and print call_rcu stack

On Mon, 2020-06-01 at 13:08 +0800, Walter Wu wrote: > This patchset improves KASAN reports by making them to have > call_rcu() call stack information. It is useful for programmers > to solve use-after-free or double-free memory issue. > > The KASAN report was as follows(clea

[PATCH v7 4/4] kasan: update documentation for generic kasan

Generic KASAN will support to record the last two call_rcu() call stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Reviewed-and-tested-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Jonathan

[PATCH v7 3/4] kasan: add tests for call_rcu stack recording

Test call_rcu() call stack recording and verify whether it correctly is printed in KASAN report. Signed-off-by: Walter Wu Reviewed-and-tested-by: Dmitry Vyukov Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Matthias Brugger --- Changes since v6: - renamed

[PATCH v7 2/4] kasan: record and print the free track

) Remove the free_track from struct kasan_alloc_meta. 2) Add the free_track into struct kasan_free_meta. 3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether it can print free stack in KASAN report. [1]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Signed-off-by: Walter Wu Suggested

[PATCH v7 1/4] rcu: kasan: record and print call_rcu() call stack

/show_bug.cgi?id=198437 [2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Acked-by: Paul E. McKenney Reviewed-and-tested-by: Dmitry Vyukov Reviewed-by: Andrey

[PATCH v7 0/4] kasan: memorize and print call_rcu stack

printing message - remove descriptions in Kocong.kasan Changes since v5: - reuse print_stack() in print_track() Changes since v6: - fix typo - renamed the variable name in testcase Walter Wu (4): rcu: kasan: record and print call_rcu() call stack kasan: record and print the free track kasan: add tests

Re: [PATCH v6 1/4] rcu/kasan: record and print call_rcu() call stack

On Mon, 2020-05-25 at 11:56 +0200, Dmitry Vyukov wrote: > On Fri, May 22, 2020 at 4:01 AM Walter Wu wrote: > > > > This feature will record the last two call_rcu() call stacks and > > prints up to 2 call_rcu() call stacks in KASAN report. > > > > When call_rcu()

[PATCH v6 3/4] kasan: add tests for call_rcu stack recording

Test call_rcu() call stack recording and verify whether it correctly is printed in KASAN report. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger --- lib/test_kasan.c | 30 ++ 1 file changed, 30

[PATCH v6 2/4] kasan: record and print the free track

) Remove the free_track from struct kasan_alloc_meta. 2) Add the free_track into struct kasan_free_meta. 3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether it can print free stack in KASAN report. [1]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Signed-off-by: Walter Wu Suggested

[PATCH v6 4/4] kasan: update documentation for generic kasan

Generic KASAN will support to record the last two call_rcu() call stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jonathan Corbet --- Documentation/dev-tools/kasan.rst | 3

[PATCH v6 1/4] rcu/kasan: record and print call_rcu() call stack

/show_bug.cgi?id=198437 [2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Acked-by: Paul E. McKenney Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko

[PATCH v6 0/4] kasan: memorize and print call_rcu stack

printing message - remove descriptions in Kocong.kasan Changes since v6: - reuse print_stack() in print_track() Walter Wu (4): rcu/kasan: record and print call_rcu() call stack kasan: record and print the free track kasan: add tests for call_rcu stack recording kasan: update documentation for generic

Re: [PATCH v5 1/4] rcu/kasan: record and print call_rcu() call stack

> On Wed, May 20, 2020 at 2:34 PM Walter Wu wrote: > > > > This feature will record the last two call_rcu() call stacks and > > prints up to 2 call_rcu() call stacks in KASAN report. > > > > When call_rcu() is called, we store the call_rcu() call stack

[PATCH v5 4/4] kasan: update documentation for generic kasan

Generic KASAN will support to record the last two call_rcu() call stacks and print them in KASAN report. So that need to update documentation. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jonathan Corbet --- Documentation/dev-tools/kasan.rst | 3

[PATCH v5 3/4] kasan: add tests for call_rcu stack recording

Test call_rcu() call stack recording and verify whether it correctly is printed in KASAN report. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger --- lib/test_kasan.c | 30 ++ 1 file changed, 30

[PATCH v5 2/4] kasan: record and print the free track

) Remove the free_track from struct kasan_alloc_meta. 2) Add the free_track into struct kasan_free_meta. 3) Add a macro KASAN_KMALLOC_FREETRACK in order to check whether print free stack in KASAN report. [1]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Signed-off-by: Walter Wu Suggested

[PATCH v5 1/4] rcu/kasan: record and print call_rcu() call stack

/show_bug.cgi?id=198437 [2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Acked-by: Paul E. McKenney Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko

[PATCH v5 0/4] kasan: memorize and print call_rcu stack

- change printing message - remove descriptions in Kocong.kasan Walter Wu (4): rcu/kasan: record and print call_rcu() call stack kasan: record and print the free track kasan: add tests for call_rcu stack recording kasan: update documentation for generic kasan Documentation/dev-tools/kasan.rst | 3

Re: [PATCH v4 2/4] kasan: record and print the free track

On Wed, 2020-05-20 at 13:15 +0200, 'Dmitry Vyukov' via kasan-dev wrote: > On Wed, May 20, 2020 at 12:15 PM Walter Wu wrote: > > > > On Wed, 2020-05-20 at 11:44 +0200, 'Dmitry Vyukov' via kasan-dev wrote: > > > On Wed, May 20, 2020 at 11:17 AM Walter Wu > > > w

Re: [PATCH v4 2/4] kasan: record and print the free track

On Wed, 2020-05-20 at 11:44 +0200, 'Dmitry Vyukov' via kasan-dev wrote: > On Wed, May 20, 2020 at 11:17 AM Walter Wu wrote: > > > > On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote: > > > > > > On Wed, May 20, 2020 at 6:03 AM Walter Wu > > > > >

Re: [PATCH v4 2/4] kasan: record and print the free track

> On Wed, May 20, 2020 at 8:18 AM Walter Wu wrote: > > > > On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote: > > > > On Wed, May 20, 2020 at 6:03 AM Walter Wu > > > > wrote: > > > > > > > > > > > On Tue, May 19, 2020 at

Re: [PATCH v4 2/4] kasan: record and print the free track

On Wed, 2020-05-20 at 13:14 +0800, Walter Wu wrote: > > On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote: > > > > > > > On Tue, May 19, 2020 at 4:25 AM Walter Wu > > > > wrote: > > > > > > > > > > Move free track from slub all

Re: [PATCH v4 2/4] kasan: record and print the free track

> On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote: > > > > > On Tue, May 19, 2020 at 4:25 AM Walter Wu > > > wrote: > > > > > > > > Move free track from slub alloc meta-data to slub free meta-data in > > > > order to make str

Re: [PATCH v4 2/4] kasan: record and print the free track

> On Wed, May 20, 2020 at 6:03 AM Walter Wu wrote: > > > > > On Tue, May 19, 2020 at 4:25 AM Walter Wu > > > wrote: > > > > > > > > Move free track from slub alloc meta-data to slub free meta-data in > > > > order to make str

Re: [PATCH v4 2/4] kasan: record and print the free track

> On Tue, May 19, 2020 at 4:25 AM Walter Wu wrote: > > > > Move free track from slub alloc meta-data to slub free meta-data in > > order to make struct kasan_free_meta size is 16 bytes. It is a good > > size because it is the minimal redzone size and a g

Re: [PATCH v4 1/4] rcu/kasan: record and print call_rcu() call stack

On Tue, 2020-05-19 at 08:48 -0700, Paul E. McKenney wrote: > On Tue, May 19, 2020 at 10:23:59AM +0800, Walter Wu wrote: > > This feature will record the last two call_rcu() call stacks and > > prints up to 2 call_rcu() call stacks in KASAN report. > > > > When cal

Re: [PATCH v4 1/4] rcu/kasan: record and print call_rcu() call stack

Hi Andrey, On Tue, 2020-05-19 at 16:52 +0200, 'Andrey Konovalov' via kasan-dev wrote: > On Tue, May 19, 2020 at 4:24 AM Walter Wu wrote: > > > > This feature will record the last two call_rcu() call stacks and > > prints up to 2 call_rcu() call stacks in KASAN report.

[PATCH v4 3/4] kasan: add tests for call_rcu stack recording

Test call_rcu() call stack recording and verify whether it correctly is printed in KASAN report. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Matthias Brugger --- lib/test_kasan.c | 30 ++ 1 file changed, 30

[PATCH v4 4/4] kasan: update documentation for generic kasan

Generic KASAN will support to record the last two call_rcu() call stacks and print them in KASAN report. So need to update documentation. Signed-off-by: Walter Wu Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Jonathan Corbet --- Documentation/dev-tools/kasan.rst | 3

[PATCH v4 2/4] kasan: record and print the free track

and kasan_free_meta: - remove free track from kasan_alloc_meta. - add free track into kasan_free_meta. [1]https://bugzilla.kernel.org/show_bug.cgi?id=198437 Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko --- mm/kasan/common.c

[PATCH v4 1/4] rcu/kasan: record and print call_rcu() call stack

/show_bug.cgi?id=198437 [2]https://groups.google.com/forum/#!searchin/kasan-dev/better$20stack$20traces$20for$20rcu%7Csort:date/kasan-dev/KQsjT_88hDE/7rNUZprRBgAJ Signed-off-by: Walter Wu Suggested-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Alexander Potapenko Cc: Andrew Morton Cc: Paul

  1   2   3   >