Re: [PATCH] kasan: skip quarantine if object is still accessible under RCU

[Jann Horn <jannh@google.com>]

On Thu, Jul 24, 2025 at 12:14 PM Vlastimil Babka <vbabka@suse.cz> wrote:
> On 7/23/25 16:59, Jann Horn wrote:
> > Currently, enabling KASAN masks bugs where a lockless lookup path gets a
> > pointer to a SLAB_TYPESAFE_BY_RCU object that might concurrently be
> > recycled and is insufficiently careful about handling recycled objects:
> > KASAN puts freed objects in SLAB_TYPESAFE_BY_RCU slabs onto its quarantine
> > queues, even when it can't actually detect UAF in these objects, and the
> > quarantine prevents fast recycling.
> >
> > When I introduced CONFIG_SLUB_RCU_DEBUG, my intention was that enabling
> > CONFIG_SLUB_RCU_DEBUG should cause KASAN to mark such objects as freed
> > after an RCU grace period and put them on the quarantine, while disabling
> > CONFIG_SLUB_RCU_DEBUG should allow such objects to be reused immediately;
> > but that hasn't actually been working.
>
> Was the "allow reuse immediately" not working also before you introduced
> CONFIG_SLUB_RCU_DEBUG, or is it a side-effect of that? IOW should we add a
> Fixes: here?

This was already an issue before. I think it got broken by refactoring
in commit b556a462eb8df6b6836c318d23f43409c40a7c7e ("kasan: save free
stack traces for slab mempools"), but I don't think it was necessarily
an intentionally supported feature.

> > I discovered such a UAF bug involving SLAB_TYPESAFE_BY_RCU yesterday; I
> > could only trigger this bug in a KASAN build by disabling
> > CONFIG_SLUB_RCU_DEBUG and applying this patch.
> >
> > Signed-off-by: Jann Horn <jannh@google.com>
>
> Acked-by: Vlastimil Babka <vbabka@suse.cz>

Thanks!