From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0135EC433DF for ; Mon, 24 Aug 2020 11:50:23 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A9785206BE for ; Mon, 24 Aug 2020 11:50:22 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="oLyJ6GRK" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A9785206BE Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 524AA6B0006; Mon, 24 Aug 2020 07:50:22 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 4FACA6B0007; Mon, 24 Aug 2020 07:50:22 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 411958D0001; Mon, 24 Aug 2020 07:50:22 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0059.hostedemail.com [216.40.44.59]) by kanga.kvack.org (Postfix) with ESMTP id 2B2806B0006 for ; Mon, 24 Aug 2020 07:50:22 -0400 (EDT) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id D30A71EF2 for ; Mon, 24 Aug 2020 11:50:21 +0000 (UTC) X-FDA: 77185294242.23.fang47_2c0a99e27052 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin23.hostedemail.com (Postfix) with ESMTP id 1FB0B37609 for ; Mon, 24 Aug 2020 11:50:21 +0000 (UTC) X-HE-Tag: fang47_2c0a99e27052 X-Filterd-Recvd-Size: 4928 Received: from mail-ot1-f68.google.com (mail-ot1-f68.google.com [209.85.210.68]) by imf24.hostedemail.com (Postfix) with ESMTP for ; Mon, 24 Aug 2020 11:50:20 +0000 (UTC) Received: by mail-ot1-f68.google.com with SMTP id x24so7014594otp.3 for ; Mon, 24 Aug 2020 04:50:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=yJXg3YmJV9VmBBuMxTtghIxF3sII7GvdsrK6BwX4Nus=; b=oLyJ6GRKHTm1t7mgGpDwN4erpee2C2K8InRMviIFM7ItOZjfGHwrLx5AqYVOyiaj2H Sut0+dlkdVXZjAi7t6gZDvKzPxSlKEVjXEXukWfDse9h4cuaBBoHnh8nLCJnowemg/gp OBPAHWMwTO2x0X0nGFhP1VkCLuv2QlfwmAOgXeKwSFhOB1mhlIHVv9tX3val2OmziOqL KPTYLiXiQBhJxzN5Qip06U+Xx/adZQ8VHy13CgZ7WTjW3CJfkqFD3cc/vMOMqxFDP2d/ ci8FSMbFgXLLI+sGzo1XDEnZB+xvTYLArHLLB9OJ+Ku8Yj8EkrGjlqkkGP0s7pdstJok DJQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yJXg3YmJV9VmBBuMxTtghIxF3sII7GvdsrK6BwX4Nus=; b=e8UsagLbOxxj051D8mEb7B+j5G/1cVviZA2jbiOtZsTRziDDPOqJ0nlrHliu6VUbro H139CivghoPIZKBY/3qZMiKAuEMQpTxMIwoP0PHDz1TO0lMtahPcWT67Xhq6alrW61k4 WJfVvK8Axx3ay3rYo8bLot6xtoIJCj1smqGhfRcrXSejMM5QyKibTK5DdG2Hgti4OX5W Paf4i0S1G1jID//UBOkCJJRJpz441Sq57yqDICBbXBZvx8a4vwFGX3zsLLw3mJm0BzNB +EFQUIgBuKYis1SZqye2HZQJI5u+Rhw1LvtVMPKJT82IM5IXjG2He4au5h4cga6Mqmkn BL9Q== X-Gm-Message-State: AOAM532okK2O/52B5qtE9hb+T4NcnGtkI0rZ3NYHAuVXuRx4TtUHBtkY /aTbnJi60rT2DYuM3herOcSuOSLdO9938FPg2MJ1Kw== X-Google-Smtp-Source: ABdhPJxY6ICnrMzo1mNkyVVmig6kmZLJrD1Ga0fs2iobFX/jQG+jCprR22w/YZrmq6KdxX46yuF7HEXTXgAX+iTF6Ik= X-Received: by 2002:a9d:739a:: with SMTP id j26mr3480830otk.17.1598269819856; Mon, 24 Aug 2020 04:50:19 -0700 (PDT) MIME-Version: 1.0 References: <20200824080706.24704-1-walter-zh.wu@mediatek.com> In-Reply-To: <20200824080706.24704-1-walter-zh.wu@mediatek.com> From: Marco Elver Date: Mon, 24 Aug 2020 13:50:08 +0200 Message-ID: Subject: Re: [PATCH v2 0/6] kasan: add workqueue and timer stack for generic KASAN To: Walter Wu Cc: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Matthias Brugger , John Stultz , Stephen Boyd , Andrew Morton , Tejun Heo , Lai Jiangshan , kasan-dev , Linux Memory Management List , LKML , Linux ARM , wsd_upstream , linux-mediatek@lists.infradead.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 1FB0B37609 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, 24 Aug 2020 at 10:07, Walter Wu wrote: > > Syzbot reports many UAF issues for workqueue or timer, see [1] and [2]. > In some of these access/allocation happened in process_one_work(), > we see the free stack is useless in KASAN report, it doesn't help > programmers to solve UAF on workqueue. The same may stand for times. > > This patchset improves KASAN reports by making them to have workqueue > queueing stack and timer queueing stack information. It is useful for > programmers to solve use-after-free or double-free memory issue. > > Generic KASAN will record the last two workqueue and timer stacks, > print them in KASAN report. It is only suitable for generic KASAN. > > [1]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work > [2]https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22%20expire_timers > [3]https://bugzilla.kernel.org/show_bug.cgi?id=198437 > > Walter Wu (6): > timer: kasan: record timer stack > workqueue: kasan: record workqueue stack > kasan: print timer and workqueue stack > lib/test_kasan.c: add timer test case > lib/test_kasan.c: add workqueue test case > kasan: update documentation for generic kasan > > --- > > Changes since v1: > - Thanks for Marco and Thomas suggestion. > - Remove unnecessary code and fix commit log > - reuse kasan_record_aux_stack() and aux_stack > to record timer and workqueue stack. > - change the aux stack title for common name. Much cleaner. In general, Acked-by: Marco Elver but I left some more comments. I'm a bit worried about the tests, because of KASAN-test KUnit rework, but probably not much we can do until these are added to -mm tree. Thanks, -- Marco